/**
 * RAW KEYCLOAK TOKEN
 * Data Layer: Represents the uncleaned decoded JWT payload from Keycloak.
 */
export interface RawKeycloakToken {
    sub: string;                     // Unique User ID
    name?: string;
    email?: string;
    preferred_username: string;
    given_name?: string;
    family_name?: string;
    email_verified: boolean;
    picture?: string;                // Avatar URL from Keycloak
    realm_access?: {
      roles: string[];               // Global roles (e.g., 'admin', 'editor')
    };
    resource_access?: {
      [key: string]: {
        roles: string[];             // Client-specific roles
      };
    };
    exp: number;                     // Expiration Timestamp
    iat: number;                     // Issued At Timestamp
  }
  
  /**
   * USER PROFILE
   * UI Layer: Represents the "Cleaned" object used by the frontend.
   * Logic: Extracted from RawKeycloakToken via session-mapper.ts.
   */
  export interface UserProfile {
    id: string;
    name: string;
    email?: string;
    username: string;
    avatar: string | null;
    roles: string[];
    isPremium: boolean;              // Derived state for the News Portal
  }
  
  /**
   * AUTH STATUS
   * Logic: Standardizes the possible states of the session.
   */
  export type AuthStatus = 'loading' | 'authenticated' | 'unauthenticated';