//! security_version 必须与 users 当前值相同；过期/撤销/MFA 判定由认证层执行。

use sea_orm::entity::Set;
use sea_orm::entity::prelude::*;
use uuid::Uuid;

#[sea_orm::model]
#[derive(Clone, Debug, PartialEq, Eq, DeriveEntityModel)]
#[sea_orm(table_name = "user_sessions")]
pub struct Model {
    #[sea_orm(primary_key, auto_increment = false)]
    pub id: Uuid,
    #[sea_orm(indexed)]
    pub user_id: i64,
    #[sea_orm(unique, column_type = "String(StringLen::N(255))")]
    pub token_hash: String,
    #[sea_orm(unique, column_type = "String(StringLen::N(255))")]
    pub refresh_token_hash: Option<String>,
    #[sea_orm(column_type = "String(StringLen::N(64))")]
    pub hash_key_id: String,
    #[sea_orm(default_value = 1)]
    pub security_version: i32,
    #[sea_orm(default_value = 1)]
    pub version: i32,
    #[sea_orm(default_expr = "Expr::current_timestamp()")]
    pub created_at: DateTimeUtc,
    #[sea_orm(default_expr = "Expr::current_timestamp()")]
    pub updated_at: DateTimeUtc,
    #[sea_orm(default_expr = "Expr::current_timestamp()")]
    pub last_seen_at: DateTimeUtc,
    pub expires_at: DateTimeUtc,
    pub refresh_expires_at: Option<DateTimeUtc>,
    pub revoked_at: Option<DateTimeUtc>,
    pub mfa_verified_at: Option<DateTimeUtc>,
    #[sea_orm(column_type = "String(StringLen::N(45))")]
    pub ip_address: Option<String>,
    #[sea_orm(column_type = "Text")]
    pub user_agent: Option<String>,

    #[sea_orm(belongs_to, from = "user_id", to = "id", on_delete = "Cascade")]
    pub user: BelongsTo<super::users::Entity>,
}

#[async_trait::async_trait]
impl ActiveModelBehavior for ActiveModel {
    async fn before_save<C>(mut self, _db: &C, insert: bool) -> Result<Self, DbErr>
    where
        C: ConnectionTrait,
    {
        if insert && self.id.is_not_set() {
            self.id = Set(Uuid::now_v7());
        }
        self.updated_at = Set(chrono::Utc::now());
        Ok(self)
    }
}