package validator

import (
	"strings"

	"browser.local/platform/domain"
)

func ValidateAuthSessionRecord(session domain.AuthSessionRecord) error {
	var violations []string
	violations = appendRequired(violations, "id", session.ID)
	violations = appendRequired(violations, "userId", session.UserID)
	violations = appendRequired(violations, "tokenHash", session.TokenHash)
	if len(strings.TrimSpace(session.TokenHash)) != 64 {
		violations = append(violations, "tokenHash must be a SHA-256 verifier")
	}
	if session.Status != domain.AuthSessionStatusActive && session.Status != domain.AuthSessionStatusRevoked {
		violations = append(violations, "status is invalid")
	}
	if session.Generation <= 0 {
		violations = append(violations, "generation must be positive")
	}
	if session.IssuedAt.IsZero() || session.ExpiresAt.IsZero() || !session.ExpiresAt.After(session.IssuedAt) {
		violations = append(violations, "session expiry must be after issue time")
	}
	if session.Status == domain.AuthSessionStatusRevoked && session.RevokedAt.IsZero() {
		violations = append(violations, "revokedAt is required for revoked sessions")
	}
	return finish(violations)
}

func ValidateRunControlSession(session domain.RunControlSession) error {
	var violations []string
	violations = appendRequired(violations, "runEndpointId", session.RunEndpointID)
	violations = appendRequired(violations, "sessionTokenHash", session.SessionTokenHash)
	if len(strings.TrimSpace(session.SessionTokenHash)) != 64 {
		violations = append(violations, "sessionTokenHash must be a SHA-256 verifier")
	}
	if session.Status != domain.AuthSessionStatusActive && session.Status != domain.AuthSessionStatusRevoked {
		violations = append(violations, "status is invalid")
	}
	if session.Generation <= 0 {
		violations = append(violations, "generation must be positive")
	}
	if session.CreatedAt.IsZero() || session.ExpiresAt.IsZero() || !session.ExpiresAt.After(session.CreatedAt) {
		violations = append(violations, "session expiry must be after creation time")
	}
	if session.Status == domain.AuthSessionStatusRevoked && session.RevokedAt.IsZero() {
		violations = append(violations, "revokedAt is required for revoked sessions")
	}
	return finish(violations)
}