"""Capability token model."""

from typing import Dict, Any
from datetime import datetime
from pydantic import BaseModel, Field
import uuid


class CapabilityToken(BaseModel):
    """
    Token that specifies which tools an agent is allowed to use.
    
    This is the core security primitive - generated by the classifier
    based ONLY on the user's original request, before any external data.
    """
    
    request_id: str = Field(default_factory=lambda: str(uuid.uuid4()))
    user_request: str = Field(..., description="Original user request")
    granted_tools: Dict[str, bool] = Field(
        default_factory=dict,
        description="Map of tool_name -> granted (True/False)"
    )
    constraints: Dict[str, Dict[str, Any]] = Field(
        default_factory=dict,
        description="Tool-specific constraints (e.g., email whitelist)"
    )
    timestamp: datetime = Field(default_factory=datetime.utcnow)
    confidence: float = Field(
        default=1.0,
        ge=0.0,
        le=1.0,
        description="Classifier confidence (0-1)"
    )
    classification_method: str = Field(
        default="unknown",
        description="Which classifier was used (rule-based, ml, llm)"
    )
    
    model_config = {
        "json_schema_extra": {
            "example": {
                "request_id": "abc-123",
                "user_request": "Summarize http://example.com",
                "granted_tools": {
                    "read_website": True,
                    "send_email": False,
                    "search_emails": False
                },
                "constraints": {},
                "confidence": 0.95,
                "classification_method": "rule-based"
            }
        }
    }
