"""Per-user security activity log - the user-facing counterpart to the
admin-only, app-wide Redis log feed (app/core/logging.py). Visible only to
the owning user via GET /auth/security-events."""

from __future__ import annotations

import uuid
from typing import TYPE_CHECKING

from sqlalchemy import Enum, ForeignKey, String
from sqlalchemy.orm import Mapped, mapped_column, relationship

from app.db.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
from app.models.enums import SecurityEventType

if TYPE_CHECKING:
    from app.models.user import User


class UserSecurityEvent(Base, UUIDPrimaryKeyMixin, TimestampMixin):
    __tablename__ = "user_security_events"

    user_id: Mapped[uuid.UUID] = mapped_column(
        ForeignKey("users.id", ondelete="CASCADE"), index=True
    )
    event_type: Mapped[SecurityEventType] = mapped_column(
        Enum(SecurityEventType, native_enum=False, length=32)
    )
    ip_address: Mapped[str] = mapped_column(String(45))

    user: Mapped[User] = relationship()