gem "seshlock"

Seshlock.configure do |config|
  config.access_token_ttl  = 15.minutes
  config.refresh_token_ttl = 30.days
end

class User < ApplicationRecord
  include Seshlock::UserMethods
  has_secure_password
end

class SessionsController < ApplicationController
  include Seshlock::ControllerMethods

  # Skip any existing auth for login
  skip_before_action :authenticate!, only: [:login]

  # Protect these endpoints with the appropriate token type
  before_action :authenticate_with_seshlock_access_token!, only: [:ping]
  before_action :authenticate_with_seshlock_refresh_token!, only: [:logout, :refresh]

  # Handle Seshlock errors gracefully
  rescue_from Seshlock::Error, with: :render_seshlock_error

  # POST /login
  def login
    result = seshlock_login(
      email: params[:email],
      password: params[:password],
      device: params[:device]
    )
    render json: result, status: :ok
  end

  # POST /logout
  def logout
    seshlock_logout
    head :ok
  end

  # POST /refresh
  def refresh
    result = seshlock_refresh(device: params[:device])
    render json: result, status: :ok
  end

  # GET /ping (protected endpoint example)
  def ping
    render json: { message: "pong", user: current_seshlock_user.email }
  end
end

Rails.application.routes.draw do
  post "login",   to: "sessions#login"
  post "logout",  to: "sessions#logout"
  post "refresh", to: "sessions#refresh"
  get  "ping",    to: "sessions#ping"
end

# Issue new tokens
token_pair = Seshlock::Sessions.issue_tokens_to(user: user, device: "iPhone")
token_pair.access_token              # => "abc123..."
token_pair.access_token_expires_at   # => Time
token_pair.refresh_token             # => "def456..."
token_pair.refresh_token_expires_at  # => Time

# Refresh (returns [access_token, expires_at] or nil)
result = Seshlock::Sessions.refresh(refresh_token: raw_token)

# Revoke
Seshlock::Sessions.revoke_refresh_token(raw_refresh_token: token)

user.seshlock_refresh_tokens  # => has_many association
user.seshlock_access_tokens   # => has_many through refresh_tokens
user.issue_seshlock_session(device: nil)  # => TokenPair

# Session Management
user.seshlock_sessions                    # => Active sessions (most recent first)
user.revoke_all_seshlock_sessions!        # => Logout everywhere
user.revoke_other_seshlock_sessions!(except_refresh_token: token)  # => Logout other devices

class SessionsController < ApplicationController
  include Seshlock::ControllerMethods

  before_action :authenticate_with_seshlock_access_token!, 
                only: [:index, :destroy, :destroy_others]
  before_action :authenticate_with_seshlock_refresh_token!, 
                only: [:destroy_all]

  # GET /sessions - List all active sessions
  def index
    render json: { sessions: seshlock_list_sessions }
    # Returns: [{ id: 1, device: "iPhone", created_at: ..., expires_at: ..., current: true }, ...]
  end

  # DELETE /sessions/:id - Revoke specific session
  def destroy
    seshlock_revoke_session(session_id: params[:id])
    head :ok
  end

  # DELETE /sessions/others - Revoke all except current
  def destroy_others
    seshlock_revoke_others
    head :ok
  end

  # DELETE /sessions/all - Revoke all (requires refresh token)
  def destroy_all
    seshlock_revoke_all
    head :ok
  end
end

rescue_from Seshlock::Error, with: :render_seshlock_error