"""Every password hash a user has ever had active - checked on password
reset so a user can't "reset" back to a password they (or an attacker who
learned it) has used before. Never used for anything except that
membership check; nothing reads these hashes back out for display."""

from __future__ import annotations

import uuid
from typing import TYPE_CHECKING

from sqlalchemy import ForeignKey, String
from sqlalchemy.orm import Mapped, mapped_column, relationship

from app.db.base import Base, TimestampMixin, UUIDPrimaryKeyMixin

if TYPE_CHECKING:
    from app.models.user import User


class PasswordHistoryEntry(Base, UUIDPrimaryKeyMixin, TimestampMixin):
    __tablename__ = "password_history_entries"

    user_id: Mapped[uuid.UUID] = mapped_column(
        ForeignKey("users.id", ondelete="CASCADE"), index=True
    )
    password_hash: Mapped[str] = mapped_column(String(255))

    user: Mapped[User] = relationship()