# #region APIKeyModel [C:1] [TYPE Module] [SEMANTICS sqlalchemy, api_key, auth, model]
# @BRIEF SQLAlchemy model for API Key authentication — stores SHA-256 hash only, raw key shown once at creation.
# @LAYER Domain
# @RELATION DEPENDS_ON -> [MappingModels]
# @INVARIANT key_hash is stored as SHA-256 hex digest (64 chars). prefix stores "ssk_" + first 7 chars.
# @INVARIANT Raw key is NEVER stored — shown once at creation and discarded.

from datetime import UTC, datetime
import uuid

from sqlalchemy import JSON, Boolean, Column, DateTime, String

from .mapping import Base


# #region APIKey [C:1] [TYPE Class]
# @BRIEF Stores API key metadata and SHA-256 hash for service-to-service authentication.
class APIKey(Base):
    __tablename__ = "api_keys"

    id = Column(String, primary_key=True, default=lambda: str(uuid.uuid4()))
    key_hash = Column(String(64), unique=True, nullable=False, index=True)  # SHA-256 hex digest
    prefix = Column(String(11), nullable=False)  # "ssk_" + 7 chars
    name = Column(String(255), nullable=False)  # Human-readable label
    environment_id = Column(String(50), nullable=True)  # Scoped to environment; null = all
    permissions = Column(JSON, nullable=False)  # e.g. ["maintenance:start", "maintenance:end"]
    active = Column(Boolean, default=True, nullable=False)
    created_at = Column(DateTime, default=lambda: datetime.now(UTC), nullable=False)
    expires_at = Column(DateTime, nullable=True)
    last_used_at = Column(DateTime, nullable=True)

    def __repr__(self) -> str:
        return f"<APIKey {self.prefix}... ({self.name})>"

# #endregion APIKey
# #endregion APIKeyModel
