"""
API Key Model - API keys for client authentication
"""
from sqlalchemy import Column, String, Integer, ForeignKey, Boolean, DateTime, JSON
from sqlalchemy.orm import relationship
from datetime import datetime

from app.models.base import BaseModel


class ApiKey(BaseModel):
    """
    API Key model for client API authentication
    """
    __tablename__ = "api_keys"

    # Owner
    user_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True)
    client_id = Column(Integer, ForeignKey("clients.id", ondelete="CASCADE"), nullable=False, index=True)

    # Key Info
    name = Column(String(255), nullable=False)
    key_prefix = Column(String(10), nullable=False)  # First 8 chars of key (for display)
    key_hash = Column(String(255), nullable=False, unique=True)  # SHA-256 hash of full key

    # Permissions
    permissions = Column(JSON, default=[])
    # Example: ["chatbot:read", "chatbot:write", "documents:read", "analytics:read"]

    # Service restrictions
    allowed_services = Column(JSON, default=[])
    # Example: ["chatbot", "document_intelligence"]

    # IP restrictions
    allowed_ips = Column(JSON, default=[])
    # Example: ["192.168.1.1", "10.0.0.0/24"]

    # Rate limiting
    rate_limit_per_minute = Column(Integer, default=60)
    rate_limit_per_hour = Column(Integer, default=1000)

    # Status
    is_active = Column(Boolean, default=True)
    is_test_key = Column(Boolean, default=False)

    # Dates
    expires_at = Column(DateTime(timezone=True), nullable=True)
    last_used_at = Column(DateTime(timezone=True), nullable=True)
    last_used_ip = Column(String(50), nullable=True)

    # Usage
    total_requests = Column(Integer, default=0)

    # Relationships
    user = relationship("User", back_populates="api_keys")

    def __repr__(self):
        return f"<ApiKey {self.name} ({self.key_prefix}...)>"

    @property
    def is_expired(self) -> bool:
        if not self.expires_at:
            return False
        return datetime.now() > self.expires_at

    @property
    def is_valid(self) -> bool:
        return self.is_active and not self.is_expired

    def has_permission(self, permission: str) -> bool:
        """Check if key has a specific permission"""
        if "*" in self.permissions:
            return True
        return permission in self.permissions

    def can_access_service(self, service: str) -> bool:
        """Check if key can access a specific service"""
        if not self.allowed_services:
            return True  # No restrictions
        return service in self.allowed_services