"""Durable, single-use password reset tokens."""

from __future__ import annotations

from datetime import datetime, timezone
from uuid import uuid4

from sqlalchemy import Boolean, DateTime, ForeignKey, String, func, text
from sqlalchemy.orm import Mapped, mapped_column

from ..db import Base


def _utc_now() -> datetime:
    return datetime.now(timezone.utc)


class PasswordResetToken(Base):
    """One hash of a one-time reset token; plaintext is never stored."""

    __tablename__ = "password_reset_tokens"

    id: Mapped[str] = mapped_column(
        String(64), primary_key=True, default=lambda: f"prt_{uuid4().hex}"
    )
    user_id: Mapped[str] = mapped_column(
        ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
    )
    token_hash: Mapped[str] = mapped_column(String(128), nullable=False)
    auth_version: Mapped[int] = mapped_column(nullable=False, default=0, server_default=text("0"))
    used: Mapped[bool] = mapped_column(
        Boolean, nullable=False, default=False, server_default=text("false")
    )
    expires_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
    created_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True), nullable=False, default=_utc_now, server_default=func.now()
    )