/**
 * Hub session lifecycle: sign + verify the hub_session cookie JWT and verify
 * the access token posted to the session-establishment endpoint.
 *
 * Grouped in a dedicated port because these three operations belong to the same
 * concern — managing the authenticated session on the hub side — and are injected
 * by the same consumers (OAuthHubSessionService, OAuthAuthorizeController,
 * OAuthSessionController).
 *
 * Separated from IJwtSigner, which is purely about issuing OAuth access/refresh
 * tokens, to keep each port's surface area minimal and its responsibility singular.
 */
export interface IHubSessionManager {
  /**
   * Signs the hub_session JWT (RS256). The token carries { sub: accountId, type: 'hub_session' }.
   * TTL is configurable via OAUTH_SESSION_COOKIE_TTL env (default 28800 s = 8 h).
   */
  signHubSession(accountId: string): string;

  /**
   * Verifies a hub_session JWT and returns the accountId (sub claim) on success,
   * or null when invalid, expired, or wrong type.
   */
  verifyHubSession(token: string): string | null;

  /**
   * Verifies an access JWT and returns the aci (accountId) claim, or null on failure.
   * Used by the session-establishment endpoint to validate the posted access token.
   */
  verifyAccessToken(token: string): string | null;
}
