namespace Csob.Models;

/// <summary>Body for <c>POST /oauth/token</c> (Authorization Code grant). Secrets travel in headers.</summary>
public sealed class TokenExchangeRequest
{
    /// <summary>Authorization code returned to the redirect URI after PSU consent.</summary>
    public string Code { get; set; } = string.Empty;
    /// <summary>Redirect URI registered for the TPP app; must match the one used to obtain the code.</summary>
    public string RedirectUri { get; set; } = string.Empty;
}

/// <summary>Body for <c>POST /oauth/refresh</c> (Refresh Token grant).</summary>
public sealed class TokenRefreshRequest
{
    public string RefreshToken { get; set; } = string.Empty;
}

/// <summary>Response of <c>GET /oauth/authorization-url</c>.</summary>
public sealed class AuthorizationUrlResponse
{
    /// <summary>Fully-built ČSOB authorization URL to which the PSU must be redirected.</summary>
    public string AuthorizationUrl { get; set; } = string.Empty;
    /// <summary>The opaque <c>state</c> value echoed back on the redirect (CSRF protection).</summary>
    public string? State { get; set; }
}