"""integrations domain — SQLAlchemy models."""
from __future__ import annotations

from datetime import datetime
from typing import Optional
from uuid import UUID, uuid4

from sqlalchemy import Boolean, ForeignKey, String, UniqueConstraint
from sqlalchemy.dialects.postgresql import JSONB
from sqlalchemy.dialects.postgresql import UUID as PGUUID
from sqlalchemy.orm import Mapped, mapped_column
from sqlalchemy.sql import func
from sqlalchemy.types import DateTime

from src.core.database import Base


class ProjectIntegration(Base):
    """One installed integration per provider per project.

    config_json holds non-secret fields (publishable keys, account IDs, from email).
    secrets_enc holds a dict of { secret_name: fernet_encrypted_value }.
    Raw secrets never leave Core — Cloud receives an opaque secret_ref.
    """

    __tablename__ = "project_integrations"

    id: Mapped[UUID] = mapped_column(PGUUID(as_uuid=True), primary_key=True, default=uuid4)
    project_id: Mapped[UUID] = mapped_column(
        PGUUID(as_uuid=True),
        ForeignKey("projects.id", ondelete="CASCADE"),
        nullable=False,
    )
    provider: Mapped[str] = mapped_column(String(40), nullable=False)
    # active | disconnected | error
    status: Mapped[str] = mapped_column(String(20), nullable=False, default="active")
    config_json: Mapped[Optional[dict]] = mapped_column(JSONB, nullable=True)
    secrets_enc: Mapped[Optional[dict]] = mapped_column(JSONB, nullable=True)
    webhook_auto_registered: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
    installed_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True), server_default=func.now()
    )
    updated_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True), server_default=func.now(), onupdate=func.now()
    )

    __table_args__ = (
        UniqueConstraint(
            "project_id", "provider", name="uq_project_integration_project_provider"
        ),
    )