/**
 * API token types — machine credentials for programmatic API access.
 */

import { z } from 'zod';

export interface ApiTokenDoc {
  id: string;
  productId: string;
  userId: string;
  userName: string;
  name: string;
  tokenType: 'user_api' | 'product_api' | 'service_api';
  environment: 'dev' | 'staging' | 'prod';
  prefix: string;
  tokenHash: string;
  status: 'active' | 'revoked' | 'expired';
  scopes: string[];
  createdAt: string;
  expiresAt: string;
  lastUsed: string | null;
  ttl?: number;
}

export type ApiTokenResponse = Omit<ApiTokenDoc, 'tokenHash'>;

export const CreateTokenSchema = z.object({
  name: z.string().min(1),
  tokenType: z.enum(['user_api', 'product_api', 'service_api']).default('product_api'),
  environment: z.enum(['dev', 'staging', 'prod']).optional(),
  scopes: z.array(z.string()).default(['read']),
  expiresInDays: z.number().int().min(1).max(365).default(90),
});

export const PatchTokenSchema = z.object({
  action: z.enum(['revoke']),
});
