Namespace SEBT.Portal.Api.Models

AuthorizationStatusResponse: Response model for GET /api/auth/status. Carries non-sensitive session claims the SPA needs to drive UI decisions (IAL gating, analytics) now that the raw JWT lives in an HttpOnly cookie and cannot be decoded client-side. Anonymous callers get this same shape with IsAuthorized false and every claim null.

CompleteLoginRequest: Request body for completing OIDC login after the Next.js server has exchanged the code and validated the id_token. CallbackToken is a short-lived JWT signed by the Next.js app (OIDC_COMPLETE_LOGIN_SIGNING_KEY) containing the IdP claims. When IsStepUp is true, updates the user's IAL level and ID proofing status instead of creating a new session. When set, returnUrl must be a safe relative path (starts with /, not //, no scheme). Otherwise it is ignored.

CompleteLoginResponse: Response body for POST /api/auth/oidc/complete-login. The portal JWT is returned via an HttpOnly cookie (see AuthCookies) — never in the response body.

OidcCallbackFailureReportRequest: Browser-reported OIDC callback failure (IdP redirect errors and missing OAuth params) for server-side logging before redirect to off-boarding. Exchange and complete-login failures are logged on the server only.

OidcCallbackRequest: request body for the server-side OIDC callback endpoint. The code_verifier and redirect_uri are never accepted from the client — they are read from the pre-auth session stored server-side. The browser only sends the authorization code and metadata needed to match the session.

RequestOtpApiRequest: Request body for requesting a one-time password (OTP) to be sent to an email address.

ValidateOtpApiRequest: Request body for validating a one-time password (OTP) for user authentication.