// Web/cookie session denylist. Thin logic layer over revokedSessions.db — mirrors
// the users/mobileSessions split (.db = SQL, .model = the API the rest of the app
// calls). A "revoked session" is a single JWT jti added on logout; requireAuth
// checks isRevoked on every authenticated request. Broad invalidation
// ("everywhere" / password change) does NOT live here — it bumps
// users.tokens_valid_after instead.

const db = require('./revokedSessions.db')

// Add a session's jti to the denylist (single-session logout). Idempotent.
async function revoke({ jti, userId, expiresAt }) {
  return db.add({ jti, userId, expiresAt })
}

// True if the given jti has been revoked (and its token hasn't expired yet).
async function isRevoked(jti) {
  return db.isRevoked(jti)
}

// Drop denylist rows whose token has already expired.
async function pruneExpired() {
  return db.pruneExpired()
}

module.exports = {
  revoke,
  isRevoked,
  pruneExpired,
}
