"""{{ user_model }} model for authentication.

⚠️ AUTO-GENERATED BY PRISM - DO NOT EDIT
"""

from __future__ import annotations

from datetime import UTC, datetime

from sqlalchemy import Boolean, DateTime, Integer, String
from sqlalchemy.dialects.postgresql import ARRAY
from sqlalchemy.orm import Mapped, mapped_column

from {{ project_name }}.models.base import Base


class {{ user_model }}(Base):
    """Application user for authentication and authorization."""

    __tablename__ = "users"

    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
    {{ username_field }}: Mapped[str] = mapped_column(String(255), unique=True, nullable=False, index=True)
{% if not is_email %}
    email: Mapped[str | None] = mapped_column(String(255), unique=True, nullable=True, index=True)
{% endif %}
{% if username_field != "username" %}
    username: Mapped[str | None] = mapped_column(String(255), nullable=True)
{% endif %}
    password_hash: Mapped[str] = mapped_column(String(255), nullable=False)
    is_active: Mapped[bool] = mapped_column(Boolean, default=True, nullable=False)
    roles: Mapped[list[str]] = mapped_column(ARRAY(String), default=list, nullable=False)

{% if email_verification %}
    # Email verification
    email_verified: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
    email_verification_token: Mapped[str | None] = mapped_column(String(255), nullable=True)
    email_verification_token_expires_at: Mapped[datetime | None] = mapped_column(
        DateTime(timezone=True), nullable=True
    )
{% endif %}

{% if password_reset %}
    # Password reset
    password_reset_token: Mapped[str | None] = mapped_column(String(255), nullable=True)
    password_reset_token_expires_at: Mapped[datetime | None] = mapped_column(
        DateTime(timezone=True), nullable=True
    )
{% endif %}

{% if account_lockout %}
    # Account lockout
    failed_login_attempts: Mapped[int] = mapped_column(Integer, default=0, nullable=False)
    locked_until: Mapped[datetime | None] = mapped_column(
        DateTime(timezone=True), nullable=True
    )
{% endif %}

{% if admin_panel_enabled %}
    # Admin bootstrap
    bootstrap_token: Mapped[str | None] = mapped_column(String(255), nullable=True)
    bootstrap_token_created_at: Mapped[datetime | None] = mapped_column(
        DateTime(timezone=True), nullable=True
    )
{% endif %}

{% if mfa_enabled %}
    # MFA / TOTP
    totp_secret: Mapped[str | None] = mapped_column(String(255), nullable=True)
    totp_enabled: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
{% endif %}

    # Timestamps
    created_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True), default=lambda: datetime.now(UTC), nullable=False
    )
    updated_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True),
        default=lambda: datetime.now(UTC),
        onupdate=lambda: datetime.now(UTC),
        nullable=False,
    )

    def __repr__(self) -> str:
        return f"<{{ user_model }} {{ '{' }}self.{{ username_field }}{{ '}' }}>"
