"""
Authentication models for managing users.
Only stores username and metadata - passwords are never stored.
Each user gets their own encrypted database file.
"""

from datetime import datetime, UTC
from functools import partial

from sqlalchemy import Column, Integer, String
from sqlalchemy_utc import UtcDateTime

from ...config.paths import get_user_database_filename
from .base import Base


class User(Base):
    """
    User model - stored in a central auth database.

    IMPORTANT — Authentication Architecture:
    Passwords are NEVER stored here (no password_hash column, no set_password
    method).  Authentication works by attempting to decrypt the user's
    per-user SQLCipher database with the supplied password.  If decryption
    succeeds the password is correct; if it fails the password is wrong.

    On password change only the SQLCipher database is rekeyed — there is
    nothing to update in this model.  Do NOT add password storage here
    without reworking the entire auth flow.
    """

    __tablename__ = "users"

    id = Column(Integer, primary_key=True)
    username = Column(String(80), unique=True, nullable=False, index=True)
    created_at = Column(UtcDateTime, default=partial(datetime.now, UTC))
    last_login = Column(UtcDateTime)

    # Metadata only - no sensitive data
    database_version = Column(Integer, default=1)

    def __repr__(self):
        return f"<User {self.username}>"

    @property
    def database_path(self):
        """Path to this user's encrypted database file."""
        return get_user_database_filename(self.username)
