/**
 * OIDC connection linking a user to an IdP
 *
 * Persistent record of the user's connection to an OIDC provider.
 * Stores the mapping between the app's user and the IdP's subject identifier.
 * Optionally stores encrypted OAuth tokens if storeTokens is enabled.
 */
export default interface OidcConnection {
    /**
     * MongoDB document ID
     */
    _id?: string;

    /**
     * Application user ID
     * References the user in your app's user collection
     */
    userId: string;

    /**
     * OIDC provider name (e.g., "acme", "contoso")
     */
    provider: string;

    /**
     * OIDC subject identifier from the IdP
     * The 'sub' claim from the ID token - unique per user per IdP
     */
    subject: string;

    /**
     * OIDC issuer identifier
     * The 'iss' claim from the ID token - identifies the IdP
     */
    issuer: string;

    /**
     * User's email from the IdP
     * Optional - for reference and display
     */
    email?: string;

    /**
     * Encrypted access token (if storeTokens enabled)
     * Used to call IdP APIs on behalf of the user
     */
    accessToken?: string;

    /**
     * Encrypted refresh token (if storeTokens enabled)
     * Used to obtain new access tokens
     */
    refreshToken?: string;

    /**
     * Encrypted ID token (if storeTokens enabled)
     * The JWT containing user claims
     */
    idToken?: string;

    /**
     * Space-separated list of granted scopes
     */
    scope?: string;

    /**
     * Access token expiration time
     */
    expiresAt?: Date;

    /**
     * Connection creation timestamp
     */
    createdAt: Date;

    /**
     * Last update timestamp
     */
    updatedAt: Date;
}