"""API key schemas for request/response models.

API keys use role-based permissions, not a separate scopes array.
When creating an API key, the user selects which roles to assign.
"""

from datetime import datetime
from uuid import UUID

from pydantic import BaseModel, Field

from vikdata.models.role import RoleResponse


class ApiKeyCreate(BaseModel):
    """API key creation request."""

    name: str = Field(..., min_length=1, max_length=255, description="Key name")
    description: str | None = Field(
        default=None,
        max_length=1000,
        description="Optional description",
    )
    role_ids: list[UUID] = Field(
        ...,
        min_length=1,
        description="Role IDs to assign to this key (determines permissions)",
    )
    expires_at: datetime | None = Field(
        default=None,
        description="Optional expiration timestamp",
    )


class ApiKeyResponse(BaseModel):
    """API key response (without full key)."""

    id: UUID = Field(..., description="Key ID")
    name: str = Field(..., description="Key name")
    description: str | None = Field(default=None, description="Key description")
    key_prefix: str = Field(..., description="First 12 characters of the key")
    created_by_id: UUID | None = Field(default=None, description="User who created the key")
    created_at: datetime = Field(..., description="Creation timestamp")
    expires_at: datetime | None = Field(default=None, description="Expiration timestamp")
    last_used_at: datetime | None = Field(default=None, description="Last usage timestamp")
    is_expired: bool = Field(..., description="Whether the key has expired")
    is_revoked: bool = Field(..., description="Whether the key has been revoked")


class ApiKeyWithRolesResponse(ApiKeyResponse):
    """API key response with assigned roles."""

    roles: list[RoleResponse] = Field(
        default_factory=list,
        description="Roles assigned to this key",
    )


class ApiKeyCreateResponse(ApiKeyWithRolesResponse):
    """API key creation response (includes full key, shown ONCE)."""

    key: str = Field(
        ...,
        description="Full API key (only returned on creation, store securely)",
    )


class ApiKeyRotateResponse(ApiKeyCreateResponse):
    """API key rotation response."""

    previous_key_prefix: str = Field(
        ...,
        description="Prefix of the rotated (revoked) key",
    )


class ApiKeyListResponse(BaseModel):
    """List of API keys response."""

    data: list[ApiKeyWithRolesResponse] = Field(..., description="List of API keys")
    total: int = Field(..., description="Total number of keys")


class ApiKeyUpdateRoles(BaseModel):
    """Update API key roles request."""

    role_ids: list[UUID] = Field(
        ...,
        min_length=1,
        description="New role IDs to assign to this key",
    )


class ApiKeyValidateRequest(BaseModel):
    """API key validation request."""

    api_key: str = Field(..., description="The API key to validate")


class ApiKeyValidateResponse(BaseModel):
    """API key validation response from internal validate-key endpoint."""

    id: UUID = Field(..., description="Key ID")
    tenant_id: UUID | None = Field(default=None, description="Tenant ID (null for superadmin keys)")
    is_active: bool = Field(..., description="Whether the key is active")
    is_superadmin: bool = Field(default=False, description="Whether this is a superadmin key")
    permissions: list[str] = Field(default_factory=list, description="Permissions granted by this key")
    ingress_requests_per_minute: int = Field(default=0, description="Rate limit for ingress")
    expires_at: datetime | None = Field(default=None, description="Expiration timestamp")
