package auth

import (
	"errors"
	"time"

	"github.com/google/uuid"
	"github.com/jackc/pgx/v5/pgtype"
)

// User is the domain representation of a registered user.
// Mirrors the sqlc-generated User row shape with Go standard types.
type User struct {
	ID           uuid.UUID
	Email        string
	PasswordHash pgtype.Text
	CreatedAt    time.Time
	UpdatedAt    time.Time
}

// Session is the domain representation of an active session row.
// The ID field holds the hex-encoded SHA-256 hash of the opaque token (D-05).
type Session struct {
	ID        string
	UserID    uuid.UUID
	CreatedAt time.Time
	ExpiresAt time.Time
}

// SessionCookieName is the HTTP cookie name used across the package.
// Decision D-12 fixes this value.
const SessionCookieName = "xtablo_session"

// SessionTTL is the sliding session lifetime (D-09).
const SessionTTL = 30 * 24 * time.Hour

// SessionExtendThreshold triggers an extension when the remaining session
// lifetime drops below this threshold (D-09 — extension runs ~once per 23 days).
const SessionExtendThreshold = 7 * 24 * time.Hour

// Sentinel errors returned by auth operations.
var (
	// ErrSessionNotFound is returned when a session lookup fails (expired, tampered, or deleted).
	ErrSessionNotFound = errors.New("auth: session not found")

	// ErrInvalidHash is returned when a stored PHC string cannot be parsed.
	ErrInvalidHash = errors.New("auth: hash is not in PHC format")

	// ErrIncompatibleVersion is returned when the argon2 version in the PHC string
	// does not match the running library version.
	ErrIncompatibleVersion = errors.New("auth: incompatible argon2 version")
)
