"""Request / response schemas for the personal-access-token endpoints."""
from __future__ import annotations

from datetime import datetime
from uuid import UUID

from pydantic import BaseModel, Field


class TokenCreateRequest(BaseModel):
    name: str = Field(
        ...,
        min_length=1,
        max_length=120,
        description="Display name for the token, e.g. 'Claude Desktop on MacBook'.",
    )
    expires_in_days: int | None = Field(
        default=90,
        description=(
            "Days until expiry. Allowed values: 30, 90, 365, or null "
            "(never expires). Defaults to 90."
        ),
    )


class TokenView(BaseModel):
    """Token row as returned to the user (no plaintext, no hash)."""

    id: UUID
    name: str
    token_prefix: str
    created_at: datetime
    expires_at: datetime | None = None
    revoked_at: datetime | None = None
    last_used_at: datetime | None = None
    last_used_ip: str | None = None
    last_used_user_agent: str | None = None
    is_active: bool


class TokenCreateResponse(BaseModel):
    """Single-use response containing the plaintext secret.

    The ``plaintext`` field is the only chance the caller has to
    capture the secret. Subsequent reads return only ``token_prefix``.
    """

    token: TokenView
    plaintext: str = Field(
        ...,
        description=(
            "The full bearer token. Show this once and never persist it; "
            "it cannot be recovered from the server."
        ),
    )


__all__ = [
    "TokenCreateRequest",
    "TokenCreateResponse",
    "TokenView",
]