<?php

declare(strict_types=1);

namespace App\Infrastructure\Auth;

use App\Domain\Auth\Role;
use App\Domain\Auth\TokenKind;
use DateTimeImmutable;

/**
 * Persistence shape for an api_tokens row, hydrated by TokenRepository.
 *
 * Mutable on `lastUsedAt` only; everything else is immutable for the
 * lifetime of the token. Note this carries the SHA-256 hash, never the
 * raw token — the raw is shown to the operator once at creation time and
 * then forgotten by the api.
 *
 * `userId` records the admin who minted the token (SEC_REVIEW F16). Set
 * for admin-kind tokens issued via the API; null for reporter / consumer /
 * service tokens, for admin tokens minted via `bin/console tokens:create`,
 * and for legacy admin rows that pre-date this binding. The auth
 * middleware only enforces user-state checks when this is non-null.
 */
final class TokenRecord
{
    public function __construct(
        public readonly ?int $id,
        public readonly TokenKind $kind,
        public readonly string $hash,
        public readonly string $prefix,
        public readonly ?int $reporterId,
        public readonly ?int $consumerId,
        public readonly ?Role $role,
        public readonly ?DateTimeImmutable $expiresAt,
        public readonly ?DateTimeImmutable $revokedAt,
        public readonly ?DateTimeImmutable $lastUsedAt,
        public readonly ?int $userId = null,
    ) {
    }
}
