# "Anyone with the link" access. The token is the secret part of the URL
# (/d/<document id>#k=<token>). It is stored in plain text so the owner can
# copy the link again at any time; the document content next to it in the
# same database is no less sensitive.
class ShareLink < ApplicationRecord
  belongs_to :document
  belongs_to :created_by, class_name: "User"
  has_many :document_memberships, dependent: :delete_all

  enum :role, { viewer: 0, editor: 1 }, validate: true

  scope :active, -> { where(revoked_at: nil) }

  before_validation(on: :create) { self.token ||= SecureRandom.urlsafe_base64(24) }

  # Revoking also removes the access people got through this link.
  def revoke!
    transaction do
      update!(revoked_at: Time.current)
      document_memberships.delete_all
    end
  end

  def as_json(*)
    { id:, role:, token:, created_at: created_at.iso8601 }
  end
end