// Package providertokens owns persistence for user-held external provider
// tokens encrypted by the personal access token service. These records are not
// AgentTeam session or authentication tokens, repository-scoped credentials, or API
// data transfer objects.
package providertokens

import "time"

const (
	// StatusActive identifies a provider token that remains eligible for its allowed usages.
	StatusActive = "active"
	// StatusRevoked identifies a provider token disabled by its owner.
	StatusRevoked = "revoked"
)

// PersonalAccessToken is the persistence projection for one encrypted,
// user-held external provider token. It is not an API DTO and does not represent
// a AgentTeam session/authentication token or a repository-scoped credential.
type PersonalAccessToken struct {
	ID                string `gorm:"primaryKey;size:64"`
	WorkspaceID       string `gorm:"size:64;not null;index:idx_personal_access_tokens_owner_updated,priority:1;index:idx_personal_access_tokens_base_status,priority:1"`
	OwnerPrincipalID  string `gorm:"size:64;not null;index:idx_personal_access_tokens_owner_updated,priority:2"`
	DisplayName       string `gorm:"size:255;not null"`
	ProviderType      string `gorm:"size:64;not null;default:'generic_git'"`
	ProviderBaseURL   string `gorm:"size:512;not null;index:idx_personal_access_tokens_base_status,priority:2"`
	Username          string `gorm:"size:255;not null;default:'x-access-token'"`
	AllowedUsagesJSON string `gorm:"type:text;not null"`
	ValueCiphertext   string `gorm:"type:text;not null"`
	Status            string `gorm:"size:32;not null;default:'active';index:idx_personal_access_tokens_base_status,priority:3"`
	LastUsedAt        *time.Time
	ExpiresAt         *time.Time `gorm:"index"`
	RevokedAt         *time.Time `gorm:"index"`
	CreatedBy         string     `gorm:"size:64;not null;default:''"`
	UpdatedBy         string     `gorm:"size:64;not null;default:''"`
	CreatedAt         time.Time  `gorm:"not null"`
	UpdatedAt         time.Time  `gorm:"not null;index:idx_personal_access_tokens_owner_updated,priority:3"`
}

// TableName preserves the canonical personal provider token table name.
func (PersonalAccessToken) TableName() string { return "personal_access_tokens" }