package model

// Reference: M13 §2 — SSO Session model
// Tracks a user's SSO session across the system for single sign-on and single logout.
// An SSO session is created when a user authenticates via SAML/OAuth and persists
// until the user explicitly logs out or the session expires.
// This enables: (1) SSO — one login grants access to all accounts for that user,
// (2) SLO — logout terminates all active sessions across all accounts,
// (3) audit — track when/where a user authenticated and from which IdP.

import (
	"time"

	"gorm.io/gorm"
)

// SSOSession represents an active SSO session for a user.
type SSOSession struct {
	ID           uint           `gorm:"primaryKey" json:"id"`
	UserID       uint           `gorm:"not null;index" json:"user_id"`
	SessionID    string         `gorm:"size:255;not null;uniqueIndex" json:"session_id"` // unique SSO session identifier
	Provider     string         `gorm:"size:50;not null" json:"provider"`                // saml, google, github
	IdPEntityID  string         `gorm:"size:512" json:"idp_entity_id,omitempty"`         // SAML IdP entity ID (for SAML sessions)
	NameID       string         `gorm:"size:512" json:"name_id,omitempty"`               // SAML NameID from the assertion
	AccountID    uint           `gorm:"not null;index" json:"account_id"`                // account context for this session
	Role         string         `gorm:"size:50" json:"role"`                             // role in the account
	AccessToken  string         `gorm:"size:512" json:"-"`                               // issued JWT access token (not exposed via API)
	RefreshToken string         `gorm:"size:512" json:"-"`                               // issued JWT refresh token (not exposed via API)
	CreatedAt    time.Time      `gorm:"autoCreateTime" json:"created_at"`
	ExpiresAt    time.Time      `gorm:"not null;index" json:"expires_at"`                // session expiry time
	LastSeenAt   time.Time      `gorm:"autoUpdateTime" json:"last_seen_at"`              // last activity timestamp
	EndedAt      *time.Time     `json:"ended_at,omitempty"`                              // when session was terminated (SLO or explicit logout)
	Status       string         `gorm:"size:20;not null;default:active" json:"status"`   // active, terminated, expired
	DeletedAt    gorm.DeletedAt `gorm:"index" json:"deleted_at,omitempty"`

	// Relations
	User    User    `gorm:"foreignKey:UserID" json:"user,omitempty"`
	Account Account `gorm:"foreignKey:AccountID" json:"account,omitempty"`
}

func (SSOSession) TableName() string { return "sso_sessions" }

// IsActive returns whether the SSO session is still valid.
func (s *SSOSession) IsActive() bool {
	return s.Status == "active" && s.EndedAt == nil && s.ExpiresAt.After(time.Now())
}

// Terminate marks the SSO session as terminated (for SLO).
func (s *SSOSession) Terminate() {
	now := time.Now()
	s.Status = "terminated"
	s.EndedAt = &now
}