from datetime import datetime

from sqlalchemy import Boolean, DateTime, String, func
from sqlalchemy.orm import Mapped, mapped_column, relationship

from app.core.database import Base
from app.models.associations import user_roles

# Where a user's credentials are verified.
AUTH_SOURCE_LOCAL = "local"
AUTH_SOURCE_LDAP = "ldap"


class User(Base):
    __tablename__ = "users"

    id: Mapped[int] = mapped_column(primary_key=True)
    email: Mapped[str] = mapped_column(String(255), unique=True, index=True)
    # Set for users provisioned from LDAP; how they sign in. Null for local users.
    username: Mapped[str | None] = mapped_column(
        String(255), unique=True, index=True, default=None
    )
    # Null for LDAP users, who have no local password (verified against LDAP).
    hashed_password: Mapped[str | None] = mapped_column(String(255), default=None)
    auth_source: Mapped[str] = mapped_column(String(16), default=AUTH_SOURCE_LOCAL)
    full_name: Mapped[str | None] = mapped_column(String(255), default=None)
    is_active: Mapped[bool] = mapped_column(Boolean, default=True)
    is_superuser: Mapped[bool] = mapped_column(Boolean, default=False)
    created_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True), server_default=func.now()
    )

    roles: Mapped[list["Role"]] = relationship(  # noqa: F821
        secondary=user_roles,
        back_populates="users",
        lazy="selectin",
    )

    @property
    def permissions(self) -> set[str]:
        """Flattened set of permission names granted via this user's roles."""
        return {perm.name for role in self.roles for perm in role.permissions}

    def has_permission(self, name: str) -> bool:
        return self.is_superuser or name in self.permissions