// Code generated by sqlc. DO NOT EDIT.
// versions:
//   sqlc v1.31.1
// source: web_sessions.sql

package db

import (
	"context"
)

const createSelfSession = `-- name: CreateSelfSession :exec
INSERT INTO web_sessions (id, user_id, refresh_token, device_name, user_agent, kind, scope, granted_by, created_at, last_used_at, expires_at)
VALUES (?, ?, '', ?, ?, ?, ?, ?, ?, ?, ?)
`

type CreateSelfSessionParams struct {
	ID         string `json:"id"`
	UserID     string `json:"user_id"`
	DeviceName string `json:"device_name"`
	UserAgent  string `json:"user_agent"`
	Kind       string `json:"kind"`
	Scope      string `json:"scope"`
	GrantedBy  string `json:"granted_by"`
	CreatedAt  int64  `json:"created_at"`
	LastUsedAt int64  `json:"last_used_at"`
	ExpiresAt  int64  `json:"expires_at"`
}

// CreateSelfSession inserts a cdrop self-signed session (kind self/guest) that has
// no IdP refresh_token (stored empty): refresh mints a fresh access token straight
// from this row without touching the IdP. Used by QR scan-login (AUTH.md 4).
func (q *Queries) CreateSelfSession(ctx context.Context, arg CreateSelfSessionParams) error {
	_, err := q.db.ExecContext(ctx, createSelfSession,
		arg.ID,
		arg.UserID,
		arg.DeviceName,
		arg.UserAgent,
		arg.Kind,
		arg.Scope,
		arg.GrantedBy,
		arg.CreatedAt,
		arg.LastUsedAt,
		arg.ExpiresAt,
	)
	return err
}

const createWebSession = `-- name: CreateWebSession :exec

INSERT INTO web_sessions (id, user_id, refresh_token, device_name, user_agent, created_at, last_used_at, expires_at)
VALUES (?, ?, ?, ?, ?, ?, ?, ?)
`

type CreateWebSessionParams struct {
	ID           string `json:"id"`
	UserID       string `json:"user_id"`
	RefreshToken string `json:"refresh_token"`
	DeviceName   string `json:"device_name"`
	UserAgent    string `json:"user_agent"`
	CreatedAt    int64  `json:"created_at"`
	LastUsedAt   int64  `json:"last_used_at"`
	ExpiresAt    int64  `json:"expires_at"`
}

// web_sessions: browser "passwordless re-login". The opaque cookie token is
// never stored; id holds its SHA-256, so a DB leak yields no usable cookie.
// refresh_token is AES-256-GCM ciphertext (key lives in the container env, not
// the DB). 7-day sliding window: every refresh rotates the token and pushes
// expires_at forward; idle sessions are reaped by DeleteExpiredWebSessions.
func (q *Queries) CreateWebSession(ctx context.Context, arg CreateWebSessionParams) error {
	_, err := q.db.ExecContext(ctx, createWebSession,
		arg.ID,
		arg.UserID,
		arg.RefreshToken,
		arg.DeviceName,
		arg.UserAgent,
		arg.CreatedAt,
		arg.LastUsedAt,
		arg.ExpiresAt,
	)
	return err
}

const deleteExpiredWebSessions = `-- name: DeleteExpiredWebSessions :execrows
DELETE FROM web_sessions
WHERE expires_at < ?
`

func (q *Queries) DeleteExpiredWebSessions(ctx context.Context, expiresAt int64) (int64, error) {
	result, err := q.db.ExecContext(ctx, deleteExpiredWebSessions, expiresAt)
	if err != nil {
		return 0, err
	}
	return result.RowsAffected()
}

const deleteWebSession = `-- name: DeleteWebSession :exec
DELETE FROM web_sessions
WHERE id = ?
`

func (q *Queries) DeleteWebSession(ctx context.Context, id string) error {
	_, err := q.db.ExecContext(ctx, deleteWebSession, id)
	return err
}

const deleteWebSessionForUser = `-- name: DeleteWebSessionForUser :execrows
DELETE FROM web_sessions
WHERE id = ? AND user_id = ?
`

type DeleteWebSessionForUserParams struct {
	ID     string `json:"id"`
	UserID string `json:"user_id"`
}

// DeleteWebSessionForUser drops one session scoped to its owner, so a user can
// only revoke their own.
func (q *Queries) DeleteWebSessionForUser(ctx context.Context, arg DeleteWebSessionForUserParams) (int64, error) {
	result, err := q.db.ExecContext(ctx, deleteWebSessionForUser, arg.ID, arg.UserID)
	if err != nil {
		return 0, err
	}
	return result.RowsAffected()
}

const getWebSession = `-- name: GetWebSession :one
SELECT id, user_id, refresh_token, device_name, user_agent, created_at, last_used_at, expires_at, kind, scope, granted_by, stepped_up_at
FROM web_sessions
WHERE id = ?
`

func (q *Queries) GetWebSession(ctx context.Context, id string) (WebSession, error) {
	row := q.db.QueryRowContext(ctx, getWebSession, id)
	var i WebSession
	err := row.Scan(
		&i.ID,
		&i.UserID,
		&i.RefreshToken,
		&i.DeviceName,
		&i.UserAgent,
		&i.CreatedAt,
		&i.LastUsedAt,
		&i.ExpiresAt,
		&i.Kind,
		&i.Scope,
		&i.GrantedBy,
		&i.SteppedUpAt,
	)
	return i, err
}

const listWebSessionsByUser = `-- name: ListWebSessionsByUser :many
SELECT id, user_id, device_name, user_agent, created_at, last_used_at, expires_at, kind, scope, granted_by
FROM web_sessions
WHERE user_id = ?
ORDER BY last_used_at DESC
`

type ListWebSessionsByUserRow struct {
	ID         string `json:"id"`
	UserID     string `json:"user_id"`
	DeviceName string `json:"device_name"`
	UserAgent  string `json:"user_agent"`
	CreatedAt  int64  `json:"created_at"`
	LastUsedAt int64  `json:"last_used_at"`
	ExpiresAt  int64  `json:"expires_at"`
	Kind       string `json:"kind"`
	Scope      string `json:"scope"`
	GrantedBy  string `json:"granted_by"`
}

// ListWebSessionsByUser lists a user's sessions for the management UI (revoke
// borrowed / guest devices). granted_by ties a scan-approved session to its
// approver for cascade revocation.
func (q *Queries) ListWebSessionsByUser(ctx context.Context, userID string) ([]ListWebSessionsByUserRow, error) {
	rows, err := q.db.QueryContext(ctx, listWebSessionsByUser, userID)
	if err != nil {
		return nil, err
	}
	defer rows.Close()
	var items []ListWebSessionsByUserRow
	for rows.Next() {
		var i ListWebSessionsByUserRow
		if err := rows.Scan(
			&i.ID,
			&i.UserID,
			&i.DeviceName,
			&i.UserAgent,
			&i.CreatedAt,
			&i.LastUsedAt,
			&i.ExpiresAt,
			&i.Kind,
			&i.Scope,
			&i.GrantedBy,
		); err != nil {
			return nil, err
		}
		items = append(items, i)
	}
	if err := rows.Close(); err != nil {
		return nil, err
	}
	if err := rows.Err(); err != nil {
		return nil, err
	}
	return items, nil
}

const rotateWebSession = `-- name: RotateWebSession :exec
UPDATE web_sessions
SET refresh_token = ?, last_used_at = ?, expires_at = ?
WHERE id = ?
`

type RotateWebSessionParams struct {
	RefreshToken string `json:"refresh_token"`
	LastUsedAt   int64  `json:"last_used_at"`
	ExpiresAt    int64  `json:"expires_at"`
	ID           string `json:"id"`
}

func (q *Queries) RotateWebSession(ctx context.Context, arg RotateWebSessionParams) error {
	_, err := q.db.ExecContext(ctx, rotateWebSession,
		arg.RefreshToken,
		arg.LastUsedAt,
		arg.ExpiresAt,
		arg.ID,
	)
	return err
}

const setSessionSteppedUp = `-- name: SetSessionSteppedUp :exec
UPDATE web_sessions
SET stepped_up_at = ?
WHERE id = ?
`

type SetSessionSteppedUpParams struct {
	SteppedUpAt int64  `json:"stepped_up_at"`
	ID          string `json:"id"`
}

// SetSessionSteppedUp stamps the moment this session last passed step-up re-auth;
// sensitive actions within the freshness window then skip re-auth (AUTH.md 6).
func (q *Queries) SetSessionSteppedUp(ctx context.Context, arg SetSessionSteppedUpParams) error {
	_, err := q.db.ExecContext(ctx, setSessionSteppedUp, arg.SteppedUpAt, arg.ID)
	return err
}

const setWebSessionDevice = `-- name: SetWebSessionDevice :exec
UPDATE web_sessions
SET device_name = ?
WHERE id = ?
`

type SetWebSessionDeviceParams struct {
	DeviceName string `json:"device_name"`
	ID         string `json:"id"`
}

func (q *Queries) SetWebSessionDevice(ctx context.Context, arg SetWebSessionDeviceParams) error {
	_, err := q.db.ExecContext(ctx, setWebSessionDevice, arg.DeviceName, arg.ID)
	return err
}

const slideWebSession = `-- name: SlideWebSession :exec
UPDATE web_sessions
SET last_used_at = ?, expires_at = ?
WHERE id = ?
`

type SlideWebSessionParams struct {
	LastUsedAt int64  `json:"last_used_at"`
	ExpiresAt  int64  `json:"expires_at"`
	ID         string `json:"id"`
}

// SlideWebSession pushes a session's sliding window forward without rotating any
// token. Self/guest sessions use it on refresh (they have no refresh_token to
// rotate); oidc sessions keep using RotateWebSession.
func (q *Queries) SlideWebSession(ctx context.Context, arg SlideWebSessionParams) error {
	_, err := q.db.ExecContext(ctx, slideWebSession, arg.LastUsedAt, arg.ExpiresAt, arg.ID)
	return err
}