package ports

import (
	"context"

	"github.com/nexuscrm/shared/pkg/models"
	"github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/permissionstatev1"
)

// AuthorizingApiTokenState is one strongly observed PAT, current user
// projection, and Permission State floor.
type AuthorizingApiTokenState struct {
	Token           models.SystemApiToken
	Subject         permissionstatev1.Subject
	Username        string
	FirstName       string
	LastName        string
	Email           string
	ProfileName     string
	UserRoleID      string
	UserRoleName    string
	UserAuthorized  bool
	PermissionFloor permissionstatev1.Version
}

// AuthorizingApiTokenRepository is additive so existing token management and
// non-authorizing consumers remain source-compatible.
type AuthorizingApiTokenRepository interface {
	LoadAuthorizingApiTokenState(
		ctx context.Context,
		tokenHash string,
	) (*AuthorizingApiTokenState, error)
}

// RuntimeAuthorizingApiTokenRepository is the bearer-free additive capability
// used after an admitted request has supplied only durable PAT/principal
// selectors to background work.
type RuntimeAuthorizingApiTokenRepository interface {
	LoadRuntimeAuthorizingApiTokenState(
		ctx context.Context,
		tokenID string,
	) (*AuthorizingApiTokenState, error)
}