const mongoose = require('mongoose')
const timestamp = require('mongoose-timestamp')

/**
 * Short-lived handshake for linking a new browser/device to an account's existing
 * E2EE identity key (QR-based, WhatsApp/Signal style) — see
 * controllers/application/account/e2eeController.js. The server only ever relays
 * `wrappedIdentityKey`: it's the private key encrypted client-side against the new
 * device's ephemeral public key, so the server never sees plaintext key material.
 */
const deviceLinkSessionSchema = new mongoose.Schema({
  user: {
    type: mongoose.Schema.Types.ObjectId,
    ref: 'User',
    required: true,
    index: true
  },
  ephemeralPublicKeyB64: {
    type: String,
    required: true
  },
  wrappedIdentityKey: {
    type: String,
    default: null
  },
  status: {
    type: String,
    enum: ['pending', 'fulfilled'],
    default: 'pending'
  },
  expiresAt: {
    type: Date,
    required: true
  }
})

deviceLinkSessionSchema.index({ expiresAt: 1 }, { expireAfterSeconds: 0 })
deviceLinkSessionSchema.plugin(timestamp)

module.exports = mongoose.model('DeviceLinkSession', deviceLinkSessionSchema)