"""Authentication schemas.

⚠️ AUTO-GENERATED BY PRISM - DO NOT EDIT
Pydantic models for authentication requests and responses.
"""

from __future__ import annotations

from pydantic import BaseModel, {% if is_email %}EmailStr, {% endif %}Field


class SignupRequest(BaseModel):
    """User registration data."""

    {{ username_field }}: {% if is_email %}EmailStr{% else %}str{% endif %}

    username: str
    password: str = Field(..., min_length={{ password_min_length }})


class LoginRequest(BaseModel):
    """{{ username_field_title }} and password for login."""

    {{ username_field }}: {% if is_email %}EmailStr{% else %}str{% endif %}

    password: str = Field(..., min_length=1)


{% if mfa_enabled %}
class LoginMFARequest(BaseModel):
    """MFA login with TOTP code."""

    {{ username_field }}: {% if is_email %}EmailStr{% else %}str{% endif %}

    code: str
{% endif %}

{% if email_verification %}
class VerifyEmailRequest(BaseModel):
    """Email verification token."""

    token: str


class ResendVerificationRequest(BaseModel):
    """Resend verification email."""

    {{ username_field }}: {% if is_email %}EmailStr{% else %}str{% endif %}

{% endif %}

{% if password_reset %}
class ForgotPasswordRequest(BaseModel):
    """Password reset request."""

    {{ username_field }}: {% if is_email %}EmailStr{% else %}str{% endif %}


class ResetPasswordRequest(BaseModel):
    """Password reset with token."""

    token: str
    password: str = Field(..., min_length={{ password_min_length }})
{% endif %}

{% if mfa_enabled %}
class MFAVerifySetupRequest(BaseModel):
    """Verify TOTP setup."""

    code: str


class MFADisableRequest(BaseModel):
    """Disable MFA."""

    password: str


class MFASetupResponse(BaseModel):
    """MFA setup response with TOTP URI."""

    totp_uri: str
    secret: str
{% endif %}


class LoginResponse(BaseModel):
    """Login response — may require MFA step."""

    requires_mfa: bool = False
    user: dict | None = None


class UserResponse(BaseModel):
    """User data returned in API responses.

    Excludes sensitive fields like password_hash.
    """

    id: int
    {{ username_field }}: str
    username: str
    is_active: bool
    roles: list[str]

    model_config = {"from_attributes": True}
