namespace EntitlementDAL.DTOs;

// MENTITLEMENTCLIENTREFRESHTOKEN — refresh-token log for client users. Insert-only except for
// RevokedOn/ReplacedByTokenId, which are set on logout/rotation. ReplacedByTokenId is a genuine,
// populated rotation chain (unlike DXP's equivalent column, which was defined but never written)
// — it is what lets EntitlementBLL.Auth.ClientAuthBLL detect token-reuse and cascade-revoke.
public class ClientRefreshTokenDTO
{
    public int       ClientRefreshTokenId { get; set; }
    public int       ClientUserId         { get; set; }
    public string    TokenHash            { get; set; } = string.Empty;  // SHA-256 hex; raw token never stored
    public DateTime  IssuedOn             { get; set; }
    public DateTime  ExpiresOn            { get; set; }
    public DateTime? RevokedOn            { get; set; }
    public int?      ReplacedByTokenId    { get; set; }

    public int      CreatedById { get; set; }
    public DateTime CreatedOn   { get; set; }
}