//! Short-lived, one-time tokens that turn a desktop API-key auth into a
//! browser session without an interactive password login.
//!
//! Lifecycle: the desktop client calls `POST /api/auth/magic-link` (API-key
//! authenticated), gets a token, opens the browser at `/web/magic?token=…`.
//! The web handler removes the token (one-time-use) and installs a regular
//! `WebSession`. TTL is intentionally short — the token only needs to
//! survive the click → browser-launch → first-request round trip.

use std::collections::HashMap;
use std::sync::Arc;
use std::time::Instant;

use tokio::sync::RwLock;

pub struct PendingMagicLink {
    pub slug: String,
    pub role: String,
    pub return_to: String,
    pub expires_at: Instant,
}

pub type MagicLinkStore = Arc<RwLock<HashMap<String, PendingMagicLink>>>;

pub fn new_store() -> MagicLinkStore {
    Arc::new(RwLock::new(HashMap::new()))
}