// Package auth issues and verifies sessions (access + refresh tokens) for
// both the admin space and the (not-yet-mounted) customer space. It has no
// database table of its own: user identity/credentials live in the users
// module, and refresh-token/session state lives entirely in Redis.
package auth

import "errors"

var (
	ErrInvalidCredentials  = errors.New("invalid credentials")
	ErrInvalidRefreshToken = errors.New("invalid refresh token")
	ErrAccountDisabled     = errors.New("account disabled")
)

// TokenPair is returned to the client on login/refresh: the access token is
// meant to be kept in memory by the frontend, the refresh token is meant to
// be set as an httpOnly cookie by the handler (never returned to JS).
type TokenPair struct {
	AccessToken  string
	RefreshToken string
}