namespace SharepointToolbox.Web.Services.Auth;

public interface ITokenRefreshService
{
    /// <summary>
    /// Exchanges a refresh token for a new access token using the public-client flow (no secret).
    /// ClientId is per-tenant (from TenantProfile) — no global secret required.
    /// </summary>
    Task<TokenRefreshResult> RefreshAsync(string refreshToken, string tenantId, string clientId, string scope);
}

public class TokenRefreshResult
{
    public string AccessToken { get; set; } = string.Empty;
    public string RefreshToken { get; set; } = string.Empty;
    public DateTimeOffset ExpiresAt { get; set; }
}