"""
Auth Schemas - ServiceManagerWeb

Pydantic schemas para autenticación y autorización.
"""

from pydantic import BaseModel, EmailStr
from typing import Optional, List


class LoginRequest(BaseModel):
    """Schema para solicitud de login."""
    email: EmailStr
    password: str
    tenant_slug: Optional[str] = None
    totp_code: Optional[str] = None


class LoginResponse(BaseModel):
    """Schema de respuesta al login exitoso."""
    access_token: str
    refresh_token: str
    token_type: str = "bearer"
    expires_in: int
    user: dict


class RefreshTokenRequest(BaseModel):
    """Schema para renovar access token usando refresh token."""
    refresh_token: str


class TokenResponse(BaseModel):
    """Schema de respuesta al renovar token."""
    access_token: str
    token_type: str = "bearer"
    expires_in: int


# ============================================================
# 2FA / TOTP Schemas
# ============================================================

class TwoFactorStatusResponse(BaseModel):
    """Estado actual de 2FA del usuario autenticado."""
    enabled: bool


class TwoFactorSetupResponse(BaseModel):
    """QR URI y clave manual devueltos al iniciar el setup de 2FA."""
    secret: str
    qr_uri: str


class TwoFactorEnableRequest(BaseModel):
    """Código TOTP para confirmar y activar 2FA."""
    totp_code: str


class TwoFactorEnableResponse(BaseModel):
    """Resultado al habilitar 2FA: incluye los códigos de respaldo."""
    enabled: bool
    backup_codes: List[str]


class TwoFactorDisableRequest(BaseModel):
    """Deshabilitar 2FA verificando con TOTP o código de respaldo."""
    totp_code: Optional[str] = None
    backup_code: Optional[str] = None


# ============================================================
# Cambio de contraseña
# ============================================================

class ChangePasswordRequest(BaseModel):
    """Schema para cambio de contraseña del usuario autenticado."""
    current_password: str
    new_password: str

    model_config = {"json_schema_extra": {"example": {"current_password": "old_pass", "new_password": "new_secure_pass"}}}


# ============================================================
# Recuperación de contraseña
# ============================================================

class ForgotPasswordRequest(BaseModel):
    """Solicitar enlace de reseteo de contraseña por email."""
    email: EmailStr


class ResetPasswordRequest(BaseModel):
    """Aplicar nueva contraseña usando token de reseteo."""
    token: str
    new_password: str