<?php

namespace App\Models;

use Illuminate\Database\Eloquent\Model;
use Illuminate\Database\Eloquent\Relations\BelongsTo;

/**
 * A single-use, short-lived handle the browser passes to the terminal sidecar; the sidecar exchanges
 * it (over the internal network, authenticated by a shared secret) for a connection spec. Burned on
 * first resolve. Never holds credentials — only points at the user + target.
 */
class TerminalSession extends Model
{
    public const UPDATED_AT = null;

    /** Explicit allowlist (never $guarded=[]) so request input can't set unintended columns. */
    protected $fillable = ['token', 'user_id', 'kind', 'server_id', 'expires_at', 'used_at', 'created_at'];

    protected $casts = [
        'expires_at' => 'datetime',
        'used_at' => 'datetime',
        'created_at' => 'datetime',
    ];

    public function server(): BelongsTo
    {
        return $this->belongsTo(Server::class);
    }

    public function user(): BelongsTo
    {
        return $this->belongsTo(User::class);
    }
}
