"""A server-wide secret (e.g. Turnstile site key/secret), encrypted at rest
(app/core/crypto.py). Unlike UserApiKey, this isn't scoped to a user - it's
one value shared by the whole app, admin-editable from the Settings page
instead of only via .env. When set,
app/services/system_secret_service.py's get_effective_settings substitutes
it in place of the server's global .env-configured value - see that module
for the full fallback logic."""

from __future__ import annotations

from sqlalchemy import Enum, Text
from sqlalchemy.orm import Mapped, mapped_column

from app.db.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
from app.models.enums import SystemSecretKey


class SystemSecret(Base, UUIDPrimaryKeyMixin, TimestampMixin):
    __tablename__ = "system_secrets"

    key: Mapped[SystemSecretKey] = mapped_column(
        Enum(SystemSecretKey, native_enum=False, length=32), unique=True
    )
    encrypted_value: Mapped[str] = mapped_column(Text)