package auth

// LoginState is the per-login data we stash in a short-lived encrypted cookie
// during /login, to validate the response at /callback.
type LoginState struct {
	State    string // CSRF token echoed back in the callback
	Verifier string // PKCE code verifier
	Nonce    string // OIDC nonce echoed back in the ID token
}

// EncodeLoginState encrypts the login state into a cookie value.
func EncodeLoginState(ls LoginState, key [32]byte) (string, error) {
	return seal(key, ls)
}

// DecodeLoginState decrypts a cookie value produced by EncodeLoginState.
func DecodeLoginState(encoded string, key [32]byte) (LoginState, error) {
	var ls LoginState
	if err := open(key, encoded, &ls); err != nil {
		return LoginState{}, err
	}
	return ls, nil
}