<?php

declare(strict_types=1);

namespace App\Administration\Infrastructure\Security;

use App\Administration\Domain\Model\User\UserId;
use App\Shared\Domain\Tenant\TenantId;
use Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface;
use Symfony\Component\Security\Core\User\UserInterface;

/**
 * Adapter between the Domain User and Symfony Security.
 *
 * This DTO is used by the Symfony authentication system.
 * It contains no business logic - it's a simple data carrier.
 *
 * @see Story 1.4 - User login
 */
final readonly class SecurityUser implements UserInterface, PasswordAuthenticatedUserInterface
{
    /** @var non-empty-string */
    private string $email;

    /**
     * @param non-empty-string $email
     * @param list<string>     $roles Symfony roles (ROLE_*)
     */
    public function __construct(
        private UserId $userId,
        string $email,
        private string $hashedPassword,
        private TenantId $tenantId,
        private array $roles,
    ) {
        $this->email = $email;
    }

    public function getUserIdentifier(): string
    {
        return $this->email;
    }

    public function userId(): string
    {
        return (string) $this->userId;
    }

    public function getPassword(): string
    {
        return $this->hashedPassword;
    }

    /**
     * @return list<string>
     */
    public function getRoles(): array
    {
        return $this->roles;
    }

    public function tenantId(): string
    {
        return (string) $this->tenantId;
    }

    /**
     * @return non-empty-string
     */
    public function email(): string
    {
        return $this->email;
    }

    public function eraseCredentials(): void
    {
        // Nothing to erase, data is immutable
    }
}
