"""users — app login identities (02-domain-model.md §1).

No password column, ever: authentication is id-auth's job (Pattern B).
A row exists so the app can attach preferences, super-admin status, and
(from M2) a party link to a BW identity. Rows are auto-provisioned with
ZERO capabilities on first sign-in (04-architecture "Sign in with BW").
"""

import uuid
from datetime import datetime

from sqlalchemy import Boolean, DateTime, ForeignKey, Text, Uuid, func
from sqlalchemy.orm import Mapped, mapped_column

from app.models.base import Base, PortableJSON


class User(Base):
    __tablename__ = "users"

    id: Mapped[uuid.UUID] = mapped_column(Uuid(), primary_key=True, default=uuid.uuid4)

    # The BW username from the verified Pattern B id_token — the stable
    # identity key (app-auth kit; judgment #31).
    idauth_username: Mapped[str] = mapped_column(Text(), unique=True)

    # BW-derived mirror, refreshed on every login (column-scoped upsert —
    # nothing else on this row is touched by a login).
    email: Mapped[str] = mapped_column(Text(), default="")

    # fk -> parties(kind=person), unique: every user IS a person (02 §1).
    # FK + unique added by alembic 0003 (deferred from M1 — ADR #002 #5).
    # NULL = no capabilities yet.
    person_party_id: Mapped[uuid.UUID | None] = mapped_column(
        ForeignKey("parties.id"), unique=True, nullable=True
    )

    is_super_admin: Mapped[bool] = mapped_column(Boolean(), default=False)

    preferences: Mapped[dict] = mapped_column(PortableJSON, default=dict)

    created_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True), server_default=func.now()
    )