package ports

import (
	"context"

	"github.com/nexuscrm/shared/pkg/models"
	"github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/permissionstatev1"
)

// AuthorizingSessionState is the durable credential, current subject, and
// Permission State floor observed by one strong repository read.
type AuthorizingSessionState struct {
	Session                models.SystemSession
	Subject                permissionstatev1.Subject
	UserRoleID             string
	UserAuthorized         bool
	ConnectedAppAuthorized bool
	PermissionFloor        permissionstatev1.Version
}

// AuthorizingSessionRepository is an additive capability. It is intentionally
// separate from SessionRepository so existing non-authorizing consumers remain
// source-compatible while new authorization composition can require it.
type AuthorizingSessionRepository interface {
	LoadAuthorizingSessionState(
		ctx context.Context,
		sessionID string,
	) (*AuthorizingSessionState, error)
}