"""Authentication domain models — users, roles, and API keys."""

from __future__ import annotations

import uuid
from datetime import datetime

from repo_core.base.models import DomainModel


class ApiKey(DomainModel):
    """API key entity for authenticating callers to the SAM backend.

    Built with ``from_attributes=True`` so it can be constructed directly
    from SQLAlchemy ORM objects or database rows.
    """

    id: uuid.UUID
    key_hash: str
    name: str
    scopes: list[str] = []  # e.g. ["accounts:read", "accounts:write", "channels:*"]
    is_active: bool = True
    created_at: datetime | None = None
    updated_at: datetime | None = None
    last_used_at: datetime | None = None


class AuthUser(DomainModel):
    """Dashboard user account used for username/password authentication."""

    id: uuid.UUID
    username: str
    email: str
    password_hash: str
    display_name: str | None = None
    role: str = "user"
    is_active: bool = True
    created_at: datetime | None = None
    updated_at: datetime | None = None
    last_login_at: datetime | None = None


class AuthRole(DomainModel):
    """Role definition for RBAC and seeded default permissions."""

    id: uuid.UUID
    name: str
    description: str | None = None
    scopes: list[str] = []
    is_active: bool = True
    created_at: datetime | None = None
    updated_at: datetime | None = None
