AutoAffiliate

import { db } from '@/lib/db';

// Strict Dual-Device Concurrency Session Guard
export async function enforceMaxTwoDevices(userId: string, currentDeviceId: string): Promise<boolean> {
  const { data: activeSessions, error } = await db
    .from('user_active_sessions')
    .select('device_id, last_heartbeat')
    .eq('user_id', userId)
    .gt('last_heartbeat', new Date(Date.now() - 5 * 60 * 1000).toISOString())
    .order('last_heartbeat', { ascending: true });

  if (error || !activeSessions) return false;

  const deviceExists = activeSessions.some(s => s.device_id === currentDeviceId);
  if (deviceExists) {
    // Update heartbeat of current device
    await db
      .from('user_active_sessions')
      .update({ last_heartbeat: new Date().toISOString() })
      .eq('device_id', currentDeviceId);
    return true;
  }

  // If already at 2 devices, evict oldest session
  if (activeSessions.length >= 2) {
    const oldestDevice = activeSessions[0].device_id;
    await db
      .from('user_active_sessions')
      .delete()
      .eq('device_id', oldestDevice);
  }

  // Register new device session
  await db
    .from('user_active_sessions')
    .insert({
      user_id: userId,
      device_id: currentDeviceId,
      last_heartbeat: new Date().toISOString()
    });

  return true;
}