package models

import "time"

// =========================================
// API TOKENS (Personal Access Tokens)
// =========================================

// APIToken represents a personal access token for programmatic API access.
// The token_hash stores the SHA-256 hash of the raw token string.
// The raw token is only shown once at creation time.
type APIToken struct {
	ID          string     `json:"id" db:"id"`
	UserID      string     `json:"user_id" db:"user_id"`
	Name        string     `json:"name" db:"name"`
	TokenHash   string     `json:"-" db:"token_hash"` // never exposed via JSON
	Prefix      string     `json:"prefix" db:"prefix"` // first 8 hex chars for identification
	Permissions []string   `json:"permissions" db:"-"`  // resolved from JSON column
	ExpiresAt   *time.Time `json:"expires_at,omitempty" db:"expires_at"`
	LastUsedAt  *time.Time `json:"last_used_at,omitempty" db:"last_used_at"`
	CreatedAt   time.Time  `json:"created_at" db:"created_at"`
	CreatedBy   *string    `json:"created_by,omitempty" db:"created_by"`
}

// APITokenCreateRequest is the JSON body for token creation.
type APITokenCreateRequest struct {
	Name        string   `json:"name"`
	Permissions []string `json:"permissions"`
	ExpiresAt   string   `json:"expires_at,omitempty"` // ISO 8601
}

// AdminTokenCreateRequest extends the create request with a target user.
type AdminTokenCreateRequest struct {
	UserID      string   `json:"user_id"`
	Name        string   `json:"name"`
	Permissions []string `json:"permissions"`
	ExpiresAt   string   `json:"expires_at,omitempty"`
}

// APITokenCreateResponse includes the raw token (shown once).
type APITokenCreateResponse struct {
	Token       string     `json:"token"` // raw token, shown once
	ID          string     `json:"id"`
	Name        string     `json:"name"`
	Prefix      string     `json:"prefix"`
	Permissions []string   `json:"permissions"`
	ExpiresAt   *time.Time `json:"expires_at,omitempty"`
	CreatedAt   time.Time  `json:"created_at"`
}