<?php

declare(strict_types=1);

namespace App\Auth;

/**
 * Claims extracted from a verified ID token. `subject` is the OIDC
 * `sub`; `email` falls back to `preferred_username` when the IdP
 * doesn't release email; `groups` is the array of Entra group object
 * IDs from the `groups` claim (empty if not configured).
 */
final class OidcClaims
{
    /**
     * @param list<string> $groups
     */
    public function __construct(
        public readonly string $subject,
        public readonly ?string $email,
        public readonly string $displayName,
        public readonly array $groups,
    ) {
    }
}
