/*
 * SPDX-License-Identifier: GPL-3.0-or-later
 */
package com.runicgateway.app.core.auth

/**
 * The at-rest home for a signed-in session (PLAN.md §4.3): the access + refresh
 * tokens plus the cached safe-user. Tokens are sensitive, so the production
 * implementation stores them in EncryptedSharedPreferences — never plain
 * DataStore or logs. Kept behind an interface so [SessionManager] is unit-testable
 * against an in-memory fake.
 */
interface TokenStore {
    /** The persisted session restored on launch, or null when signed out. */
    fun load(): StoredSession?

    /** Persist (overwrite) the current session atomically. */
    fun save(session: StoredSession)

    /** Wipe every stored token — sign-out and the Settings → Server hard reset (§3). */
    fun clear()
}

/** A persisted session: the token pair and the non-sensitive user it belongs to. */
data class StoredSession(
    val accessToken: String,
    val refreshToken: String,
    val userId: Long,
    val username: String,
    val role: String,
)
