"""Domain entity: WorkspaceInvitation (single-use partner invite).

token_hash stores SHA-256(raw_token). The raw token is returned to the caller
once and never persisted. Redemption compares SHA-256(presented_token) against
this hash.
"""

from dataclasses import dataclass
from datetime import datetime
from uuid import UUID


@dataclass
class WorkspaceInvitation:
    id: UUID
    workspace_id: UUID
    token_hash: str  # SHA-256 of the one-time token; raw token never stored
    invited_by_user_id: UUID
    status: str  # 'pending' | 'accepted' | 'revoked' | 'expired'
    expires_at: datetime
    created_at: datetime
    accepted_at: datetime | None = None