"""Access-management domain models (SQLModel tables)."""

from datetime import UTC, datetime
from uuid import UUID, uuid4

from sqlalchemy import Column, DateTime
from sqlmodel import Field, SQLModel


def utcnow() -> datetime:
    return datetime.now(UTC)


def _ts_column() -> Column:
    return Column(DateTime(timezone=True))


class User(SQLModel, table=True):
    """A person with API access. Role is member or admin."""

    __tablename__ = "users"

    id: UUID = Field(default_factory=uuid4, primary_key=True)
    email: str = Field(index=True, unique=True, max_length=320)
    name: str = Field(default="", max_length=200)
    # member | admin
    role: str = Field(default="member", max_length=20)
    tenant_id: str = Field(default="default", max_length=200)
    created_at: datetime = Field(default_factory=utcnow, sa_column=_ts_column())


class AccessRequest(SQLModel, table=True):
    """A public request for access; an admin approves or rejects it."""

    __tablename__ = "access_requests"

    id: UUID = Field(default_factory=uuid4, primary_key=True)
    name: str = Field(max_length=200)
    email: str = Field(index=True, max_length=320)
    reason: str = Field(default="", max_length=2000)
    # pending | approved | rejected
    status: str = Field(default="pending", index=True, max_length=20)
    created_at: datetime = Field(default_factory=utcnow, sa_column=_ts_column())
    decided_at: datetime | None = Field(default=None, sa_column=_ts_column())
    decided_by: str | None = Field(default=None, max_length=320)


class MagicLinkToken(SQLModel, table=True):
    """A single-use 15-minute login token. Only the sha256 is stored."""

    __tablename__ = "magic_link_tokens"

    id: UUID = Field(default_factory=uuid4, primary_key=True)
    user_id: UUID = Field(foreign_key="users.id", index=True)
    token_hash: str = Field(index=True, unique=True, max_length=64)
    expires_at: datetime = Field(sa_column=_ts_column())
    # Set before the session row is created, so a reused token can never
    # mint a second session.
    used_at: datetime | None = Field(default=None, sa_column=_ts_column())
    created_at: datetime = Field(default_factory=utcnow, sa_column=_ts_column())


class UserSession(SQLModel, table=True):
    """An opaque session id in the DB (cookie value). Revocable, expirable."""

    __tablename__ = "user_sessions"

    id: str = Field(primary_key=True, max_length=128)
    user_id: UUID = Field(foreign_key="users.id", index=True)
    created_at: datetime = Field(default_factory=utcnow, sa_column=_ts_column())
    expires_at: datetime = Field(sa_column=_ts_column())
    revoked_at: datetime | None = Field(default=None, sa_column=_ts_column())