//! TokenService port — JWT access and refresh token abstraction.
//!
//! Defines the trait that JWT adapter implementations provide. Covers
//! token generation (pair of access + refresh tokens) and access token
//! verification (returns the subject claim).

use anyhow::Result;

/// Abstraction for JWT-based token generation and verification.
///
/// Implementors handle signing key management, token serialisation,
/// and expiry validation. The trait is `Send + Sync` for use across
/// thread boundaries.
pub trait TokenService: Send + Sync {
    /// Generate an access + refresh token pair for the given subject
    /// identifier.
    ///
    /// Returns `(access_token, refresh_token)`.
    fn generate_tokens(&self, sub: &str) -> Result<(String, String)>;

    /// Verify an access token and return the embedded subject claim.
    ///
    /// Returns `Err` if the token is expired, malformed, or has an
    /// invalid signature.
    fn verify_access_token(&self, token: &str) -> Result<String>;

    /// Verify a refresh token and return the embedded subject claim.
    ///
    /// Returns `Err` if the token is expired, malformed, or has an
    /// invalid signature.
    fn verify_refresh_token(&self, token: &str) -> Result<String>;
}