"""API tokens for the operator/admin client portals (Bearer auth)."""
import secrets
from datetime import timedelta

from django.db import models
from django.utils import timezone

from testing_app.models import User

TOKEN_LIFETIME_DAYS = 7  # matches the 7-day session policy


def _new_key():
    return secrets.token_hex(24)


def _default_expiry():
    return timezone.now() + timedelta(days=TOKEN_LIFETIME_DAYS)


class ApiToken(models.Model):
    """LEGACY - superseded by JWT (SimpleJWT). Kept only so the table isn't
    dropped mid-project; nothing in the codebase reads/writes it any more."""
    user = models.ForeignKey(User, on_delete=models.CASCADE, related_name='api_tokens')
    key = models.CharField(max_length=64, unique=True, default=_new_key)
    role = models.CharField(max_length=20)  # OPERATOR or ADMIN (the portal logged into)
    created_at = models.DateTimeField(auto_now_add=True)
    expires_at = models.DateTimeField(default=_default_expiry)

    class Meta:
        db_table = 'api_tokens'
        ordering = ['-created_at']

    def is_valid(self):
        return self.expires_at > timezone.now()

    def __str__(self):
        return f"{self.user.email} [{self.role}] until {self.expires_at:%Y-%m-%d %H:%M}"


class RevokedToken(models.Model):
    """A single refresh token's jti that has been revoked (logout, or replaced
    by rotation in /auth/refresh). Custom, minimal replacement for SimpleJWT's
    built-in token_blacklist app, which assumes Django's own auth.User model -
    this project intentionally uses its own User model instead.

    For "logout everywhere" (FR-3), User.token_version is bumped instead of
    tracking every token individually - see api/jwt_auth.py."""
    jti = models.CharField(max_length=64, unique=True)
    user = models.ForeignKey(User, on_delete=models.CASCADE, related_name='revoked_tokens')
    revoked_at = models.DateTimeField(auto_now_add=True)

    class Meta:
        db_table = 'revoked_tokens'

    def __str__(self):
        return f"revoked {self.jti[:8]}… for {self.user.email}"