"""Credential — encrypted blob (cookies/token) scoped per-platform,
not per-source. One Patreon credential serves every Patreon source.

Schema aligned with GallerySubscriber's wire format (FC-3b) so the
existing browser extension hits FC unmodified.
"""

from datetime import datetime

from sqlalchemy import DateTime, Integer, LargeBinary, String, func
from sqlalchemy.orm import Mapped, mapped_column

from .base import Base


class Credential(Base):
    __tablename__ = "credential"

    id: Mapped[int] = mapped_column(Integer, primary_key=True)
    platform: Mapped[str] = mapped_column(String(64), nullable=False, unique=True)
    credential_type: Mapped[str] = mapped_column(String(32), nullable=False)  # cookies|token
    encrypted_blob: Mapped[bytes] = mapped_column(LargeBinary, nullable=False)
    captured_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True), nullable=False, server_default=func.now()
    )
    expires_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
    last_verified: Mapped[datetime | None] = mapped_column(
        DateTime(timezone=True), nullable=True
    )