package model

import (
	"strings"
	"time"
)

// User is a human account authenticated by a verified email or mobile plus password.
type User struct {
	ID          string
	Email       string
	Mobile      string
	Name        string
	DisplayName string
	AvatarURL   string
	IsAdmin     bool
	// PasswordHash is only populated when explicitly loaded for password verification.
	// Most store queries intentionally leave it empty to minimize sensitive field exposure.
	PasswordHash     string
	EmailVerifiedAt  *time.Time
	MobileVerifiedAt *time.Time
	CreatedAt        time.Time
	UpdatedAt        time.Time
}

func (user User) HasVerifiedEmail() bool {
	return user.EmailVerifiedAt != nil
}

func (user User) HasVerifiedMobile() bool {
	return strings.TrimSpace(user.Mobile) != "" && user.MobileVerifiedAt != nil
}

func (user User) HasVerifiedIdentity() bool {
	return user.HasVerifiedEmail() || user.HasVerifiedMobile()
}

// UserSession authenticates public API requests from a human user.
type UserSession struct {
	ID              string
	UserID          string
	SessionFamilyID *string
	ExpiresAt       time.Time
	CreatedAt       time.Time
	RevokedAt       *time.Time
}

// MobileSession is one revocable miniapp login, including all access and
// refresh tokens rotated from the original QR pairing exchange.
type MobileSession struct {
	ID             string
	DeviceName     string
	DevicePlatform string
	ExpiresAt      time.Time
	CreatedAt      time.Time
}