"""User account model.

`password_hash` is nullable because `AUTH_MODE=local` provisions a single
fixed user with no password at all - that mode never routes through
password verification, so there's nothing to hash.
"""

from __future__ import annotations

import uuid
from datetime import datetime
from typing import TYPE_CHECKING

from sqlalchemy import Boolean, DateTime, Integer, String
from sqlalchemy.orm import Mapped, mapped_column, relationship

from app.db.base import Base, TimestampMixin, UUIDPrimaryKeyMixin

if TYPE_CHECKING:
    from app.models.refresh_token import RefreshToken

# Fixed, deterministic user id used for AUTH_MODE=local so the same row is
# reused across restarts rather than multiplying "local dev user" rows.
LOCAL_DEV_USER_ID = uuid.UUID("00000000-0000-0000-0000-000000000001")
LOCAL_DEV_USER_EMAIL = "local@ci-agent.local"


class User(Base, UUIDPrimaryKeyMixin, TimestampMixin):
    __tablename__ = "users"

    email: Mapped[str] = mapped_column(String(320), unique=True, index=True)
    password_hash: Mapped[str | None] = mapped_column(String(255), nullable=True)
    display_name: Mapped[str] = mapped_column(String(120))
    timezone: Mapped[str] = mapped_column(String(64), default="America/New_York")
    is_active: Mapped[bool] = mapped_column(Boolean, default=True)
    is_admin: Mapped[bool] = mapped_column(Boolean, default=False)

    # Phase 19: email verification + escalating failed-login lockout. The
    # fixed AUTH_MODE=local user is seeded as already-verified (it never
    # goes through this flow - see auth_service.get_or_create_local_user).
    email_verified: Mapped[bool] = mapped_column(Boolean, default=False)
    failed_login_count: Mapped[int] = mapped_column(Integer, default=0)
    locked_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)

    refresh_tokens: Mapped[list[RefreshToken]] = relationship(
        back_populates="user", cascade="all, delete-orphan"
    )