"""Pydantic models for GitHub auth forwarding and cloud access response."""

from datetime import datetime
from typing import Literal, Optional

from pydantic import AliasChoices, BaseModel, Field


class BackendAccess(BaseModel):
    """URL and optional token for a backend (metrics or logs)."""

    url: str = Field(..., description="Backend base URL")
    token: Optional[str] = Field(None, description="Optional bearer token for the backend")


class S3Access(BaseModel):
    """
    S3-compatible storage credentials from the auth service.

    S3-compatible backend: AWS S3 or Alicloud OSS (S3-compatible mode).
    Used for read_delta when the auth service returns storage access.
    """

    provider: Literal["aws", "alicloud"] = Field(
        ...,
        description="S3-compatible provider: aws (S3), alicloud (OSS S3-compatible)",
    )
    access_key_id: Optional[str] = Field(None, description="Access key ID")
    secret_access_key: str = Field(..., description="Secret access key / account key")
    region: Optional[str] = Field(None, description="Region (e.g. us-east-1, oss-cn-hangzhou)")
    endpoint: Optional[str] = Field(None, description="Custom endpoint")
    account_name: Optional[str] = Field(None, description="Storage account name")
    session_token: Optional[str] = Field(None, description="Optional session token (e.g. AWS STS)")


class AccessTokenResponse(BaseModel):
    """Response from backend auth API (1): auth to get access_token."""

    access_token: Optional[str] = Field(
        None,
        validation_alias=AliasChoices("access_token"),
        description="Raw access_token field returned by backend when present.",
    )
    token: Optional[str] = Field(
        None,
        validation_alias=AliasChoices("token"),
        description="JWT from auth service; cached and used for subsequent API calls",
    )
    expiration: Optional[datetime] = Field(
        None,
        description="Absolute token expiration time from backend (ISO 8601).",
    )
    provider: Optional[Literal["aws", "alicloud", "gcp"]] = Field(
        None,
        description="Cloud provider selected by backend for this auth payload.",
    )
    auth0_token: Optional[str] = Field(
        None,
        validation_alias=AliasChoices("auth0_token"),
        description="Auth0 token for O11Y control-plane APIs (e.g. GS clusters lookup)",
    )
    observability_global_service: Optional[str] = Field(
        None,
        validation_alias=AliasChoices(
            "observability_global_service",
            "observabilityGlobalService",
        ),
        description="Observability Global Service base URL",
    )
    access_key_id: Optional[str] = Field(
        None,
        validation_alias=AliasChoices("access_key_id"),
        description="Cloud access key ID for S3-compatible access",
    )
    secret_access_key: Optional[str] = Field(
        None,
        validation_alias=AliasChoices("secret_access_key"),
        description="Cloud secret access key for S3-compatible access",
    )
    session_token: Optional[str] = Field(
        None,
        validation_alias=AliasChoices("session_token", "security_token"),
        description="Optional session token for S3-compatible access",
    )


class AuthResponse(BaseModel):
    """
    Aggregated auth data used by MCP auth cache and token/credential helpers.

    Built from backend API /client/auth and cached for reuse by all tools.
    """

    access_token: Optional[str] = Field(
        None,
        description="JWT from auth service for MCP/backend; cached and auto-refreshed when expired",
    )
    gcp_access_token: Optional[str] = Field(
        None,
        description=(
            "GCP OAuth access token used for GCS object access when provider is gcp."
        ),
    )
    expires_in: Optional[int] = Field(
        None,
        description="JWT lifetime in seconds from issue; used for cache expiry",
    )
    auth0_token: Optional[str] = Field(
        None,
        alias="auth0Token",
        validation_alias=AliasChoices("auth0Token", "auth0_token"),
        description="Auth0 token for O11Y control-plane APIs (e.g. GS clusters lookup)",
    )
    observability_global_service: Optional[str] = Field(
        None,
        alias="observabilityGlobalService",
        description="Observability Global Service base URL; persisted locally when present",
    )
    s3_access: Optional[S3Access] = Field(
        None,
        description=(
            "S3-compatible credentials returned from /client/auth (AWS/Alicloud) "
            "and reused by read_delta."
        ),
    )


class CloudAccessEntry(BaseModel):
    """
    Stored entry for cloud access by (cluster_id, env, deploy_type).

    Value holds S3-compatible access and backend URLs for metrics, logs, and S3.
    metrics_url and metrics_token are also used to cache resolved metrics URL from
    Observability Global Service.
    """

    s3_access: Optional[S3Access] = Field(
        None,
        description="S3-compatible storage credentials (replaces former account + permissions)",
    )
    metrics_url: Optional[str] = Field(None, description="Metrics backend (Prometheus) URL")
    metrics_token: Optional[str] = Field(
        None,
        description="Optional bearer token for the metrics endpoint (from resolve)",
    )
    logs_url: Optional[str] = Field(None, description="Logs backend URL")
    s3_url: Optional[str] = Field(
        None,
        description="S3-compatible storage endpoint or base URL",
    )