"""A user's own API key for a given third-party provider, encrypted at
rest (app/core/crypto.py). When set, app/services/user_api_key_service.py's
get_effective_settings substitutes it in place of the server's global
.env-configured key for that user's own requests - see that module for the
full fallback logic."""

from __future__ import annotations

import uuid
from typing import TYPE_CHECKING

from sqlalchemy import Enum, ForeignKey, Text, UniqueConstraint
from sqlalchemy.orm import Mapped, mapped_column, relationship

from app.db.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
from app.models.enums import ApiKeyProvider

if TYPE_CHECKING:
    from app.models.user import User


class UserApiKey(Base, UUIDPrimaryKeyMixin, TimestampMixin):
    __tablename__ = "user_api_keys"
    __table_args__ = (
        UniqueConstraint("user_id", "provider", name="uq_user_api_keys_user_provider"),
    )

    user_id: Mapped[uuid.UUID] = mapped_column(
        ForeignKey("users.id", ondelete="CASCADE"), index=True
    )
    provider: Mapped[ApiKeyProvider] = mapped_column(
        Enum(ApiKeyProvider, native_enum=False, length=16)
    )
    encrypted_key: Mapped[str] = mapped_column(Text)

    user: Mapped[User] = relationship()