<?php

namespace App\Models;

use Illuminate\Database\Eloquent\Model;

/**
 * The SSH login for the "Clusev host" terminal (a singleton — one host). Stored encrypted; only
 * ever read over the internal network by the terminal resolve endpoint, never sent to the browser.
 * When no row exists the host terminal is "not configured" and the tile opens the setup form.
 */
class HostCredential extends Model
{
    /** Explicit allowlist (never $guarded=[]) so request input can't set unintended columns. */
    protected $fillable = ['host', 'port', 'username', 'auth_type', 'secret', 'passphrase'];

    /** Never serialize the credential fields (mirrors SshCredential). */
    protected $hidden = ['secret', 'passphrase'];

    protected $casts = [
        'port' => 'integer',
        'secret' => 'encrypted',
        'passphrase' => 'encrypted',
    ];

    /** The single configured host login, or null when the operator hasn't set one up yet. */
    public static function current(): ?self
    {
        return static::query()->orderBy('id')->first();
    }
}