namespace StellaOps.Auth.Abstractions;

/// <summary>
/// Canonical claim type identifiers used across StellaOps services.
/// </summary>
public static class StellaOpsClaimTypes
{
    /// <summary>
    /// Subject identifier claim (maps to <c>sub</c> in JWTs).
    /// </summary>
    public const string Subject = "sub";

    /// <summary>
    /// StellaOps tenant identifier claim (multi-tenant deployments).
    /// </summary>
    public const string Tenant = "stellaops:tenant";

    /// <summary>
    /// OAuth2/OIDC client identifier claim (maps to <c>client_id</c>).
    /// </summary>
    public const string ClientId = "client_id";

    /// <summary>
    /// Unique token identifier claim (maps to <c>jti</c>).
    /// </summary>
    public const string TokenId = "jti";

    /// <summary>
    /// Authentication method reference claim (<c>amr</c>).
    /// </summary>
    public const string AuthenticationMethod = "amr";

    /// <summary>
    /// Space separated scope list (<c>scope</c>).
    /// </summary>
    public const string Scope = "scope";

    /// <summary>
    /// Individual scope items (<c>scp</c>).
    /// </summary>
    public const string ScopeItem = "scp";

    /// <summary>
    /// OAuth2 resource audiences (<c>aud</c>).
    /// </summary>
    public const string Audience = "aud";

    /// <summary>
    /// Identity provider hint for downstream services.
    /// </summary>
    public const string IdentityProvider = "stellaops:idp";

    /// <summary>
    /// Session identifier claim (<c>sid</c>).
    /// </summary>
    public const string SessionId = "sid";
}
