namespace Monitor.Backend.Application;

public enum PrincipalKind
{
    Anonymous,
    Session,
    Token,
}

/// <summary>访问级别：作用域为 read 的令牌只读，admin 可以管理，release 只能登记发布清单（给 CI 用，什么都读不了）。</summary>
public enum ApiScope
{
    None = 0,
    Release = 1,
    Read = 2,
    Admin = 3,
}

public sealed record Principal(PrincipalKind Kind, ApiScope Scope, string? UserId, string? Username, string? CsrfToken, string? TokenId)
{
    public static Principal Anonymous { get; } = new(PrincipalKind.Anonymous, ApiScope.None, null, null, null, null);

    public bool CanRead => Scope >= ApiScope.Read;

    public bool IsAdmin => Scope >= ApiScope.Admin;

    public bool CanPublishRelease => Scope is ApiScope.Release or ApiScope.Admin;
}

public sealed record LoginResult(string SessionToken, string CsrfToken, long ExpiresAtMs, string UserId, string Username);

public sealed record CreatedApiToken(ApiTokenRecord Record, string Plaintext);