<?php

declare(strict_types=1);

namespace Plugin\tnt_mcp\src\Mcp\Backend;

use RuntimeException;

/**
 * The presented OAuth token predates admin-identity binding: its `cUserId` is the legacy constant
 * {@see \Plugin\tnt_mcp\src\Mcp\OAuth\Entities\ShopUserEntity::IDENTIFIER} (`'shop'`) rather than a
 * `tadminlogin.cLogin`.
 *
 * This is a **privilege-escalation boundary, not a compatibility gap**. Such a token records that
 * *somebody* approved a consent, but not *who* — so there is no acting admin, and picking one
 * (the first row, the ADMINGROUP row, a configured default) would silently grant an old token an
 * identity nobody ever consented to. Fail loudly and make the client re-authorise instead.
 */
final class LegacyTokenException extends RuntimeException
{
}
