/**
 * Backoffice session model. Same security model as identity sessions:
 * only the SHA-256 hash of the opaque token is persisted; the raw token
 * lives exclusively in the cookie.
 */
export interface BackofficeSession {
  id: string;
  userId: string;
  createdAt: Date;
  expiresAt: Date;
  revokedAt: Date | null;
}

/** Backoffice session lifetime: 8 hours (shorter than storefront 7 days). */
export const BACKOFFICE_SESSION_TTL_MS = 8 * 60 * 60 * 1000;

export function backofficeSessionExpiry(now: Date = new Date()): Date {
  return new Date(now.getTime() + BACKOFFICE_SESSION_TTL_MS);
}
