first

backend/internal/modules/auth/model.go

@@ -0,0 +1,21 @@
+// Package auth issues and verifies sessions (access + refresh tokens) for
+// both the admin space and the (not-yet-mounted) customer space. It has no
+// database table of its own: user identity/credentials live in the users
+// module, and refresh-token/session state lives entirely in Redis.
+package auth
+
+import "errors"
+
+var (
+	ErrInvalidCredentials  = errors.New("invalid credentials")
+	ErrInvalidRefreshToken = errors.New("invalid refresh token")
+	ErrAccountDisabled     = errors.New("account disabled")
+)
+
+// TokenPair is returned to the client on login/refresh: the access token is
+// meant to be kept in memory by the frontend, the refresh token is meant to
+// be set as an httpOnly cookie by the handler (never returned to JS).
+type TokenPair struct {
+	AccessToken  string
+	RefreshToken string
+}