package com.baiyue.common.security;

import java.util.Set;

/** Server-side access session and its current authorization snapshot. */
public record AccessTokenSession(int version, Long userId, Set<String> roles,
                                 Set<String> permissions) {
    public AccessTokenSession {
        if (version != 1 || userId == null || userId <= 0) {
            throw new IllegalArgumentException("Invalid access token session");
        }
        roles = roles == null ? Set.of() : Set.copyOf(roles);
        permissions = permissions == null ? Set.of() : Set.copyOf(permissions);
    }
}