using Baya.Domain.Common;

namespace Baya.Domain.Entities.User;

/// <summary>
/// A revocable refresh-token session. Only the deterministic hash of the refresh token is stored —
/// never the raw token. Each refresh rotates: the presented session is revoked and a new one issued;
/// a token presented against an already-revoked session is treated as a stolen-token signal and all of
/// the user's sessions are revoked.
/// </summary>
public class UserSession : BaseEntity<long>
{
    public int UserId { get; set; }
    public User User { get; set; }

    public string RefreshTokenHash { get; set; }
    public string DeviceInfo { get; set; }
    public string IpAddress { get; set; }

    public bool IsRevoked { get; set; }
    public DateTimeOffset? RevokedAt { get; set; }
    public DateTimeOffset ExpiresAt { get; set; }

    public void Revoke(DateTimeOffset now)
    {
        IsRevoked = true;
        RevokedAt = now;
    }
}