<?php

namespace App\Models;

use Illuminate\Database\Eloquent\Model;
use Illuminate\Database\Eloquent\Relations\BelongsTo;
use Illuminate\Support\Str;

class SshCredential extends Model
{
    protected $guarded = [];

    // Hidden from serialization; encrypted at rest via APP_KEY.
    protected $hidden = ['secret', 'passphrase'];

    protected $casts = [
        'secret' => 'encrypted',
        'passphrase' => 'encrypted',
        'disabled_at' => 'datetime',
        'last_used_at' => 'datetime',
    ];

    protected static function booted(): void
    {
        static::creating(fn (self $c) => $c->uuid ??= (string) Str::uuid());
    }

    public function server(): BelongsTo
    {
        return $this->belongsTo(Server::class);
    }

    /** A "gesperrt" (disabled) credential is kept on record but refused by the vault. */
    public function getDisabledAttribute(): bool
    {
        return $this->disabled_at !== null;
    }
}