from __future__ import annotations
import enum
import uuid
from datetime import datetime, timezone
from sqlalchemy import Boolean, DateTime, Enum, String, UniqueConstraint
from sqlalchemy.orm import Mapped, mapped_column
from .base import Base


class UserRole(str, enum.Enum):
    admin = "admin"
    operator = "operator"
    viewer = "viewer"


# Where a user's identity lives. A local user signs in with a Steward
# password; an ldap or oidc user is created at their first sign-in, holds an
# unusable password, and is found again only by (auth_source, external_id) —
# never by a matching username, so a directory cannot sign in as a local account.
AUTH_SOURCES = ("local", "ldap", "oidc")


class User(Base):
    __tablename__ = "users"
    __table_args__ = (UniqueConstraint("auth_source", "external_id", name="uq_users_auth_source_external_id"),)

    id: Mapped[str] = mapped_column(String(36), primary_key=True, default=lambda: str(uuid.uuid4()))
    username: Mapped[str] = mapped_column(String(64), unique=True, nullable=False)
    email: Mapped[str] = mapped_column(String(255), unique=True, nullable=False)
    password_hash: Mapped[str] = mapped_column(String(255), nullable=False)
    role: Mapped[UserRole] = mapped_column(Enum(UserRole), nullable=False, default=UserRole.viewer)
    created_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True), nullable=False, default=lambda: datetime.now(timezone.utc)
    )
    is_active: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True)
    auth_source: Mapped[str] = mapped_column(String(16), nullable=False, default="local", server_default="local")
    # The provider's stable id: the LDAP entry DN, or the OIDC `sub`. None for local users.
    external_id: Mapped[str | None] = mapped_column(String(512), nullable=True)