#nullable enable
namespace Baya.Application.Models.Identity;

/// <summary>
/// The token pair returned by OTP verification and refresh. <see cref="Roles"/> is empty for a fresh
/// user — the client's role router sends them to role selection.
/// </summary>
public record AuthTokensResult(
    string AccessToken,
    string RefreshToken,
    DateTimeOffset AccessExpiresAt,
    DateTimeOffset RefreshExpiresAt,
    bool IsNewUser,
    IReadOnlyList<string> Roles);