"""
TenantPermission Model - ServiceManagerWeb

Permisos dinámicos por tenant.
- Si user_id es None → aplica al rol completo (default del tenant)
- Si user_id tiene valor → override individual para ese usuario
"""
from sqlalchemy import String, Boolean, ForeignKey, UniqueConstraint
from sqlalchemy.orm import Mapped, mapped_column, relationship
from typing import Optional
import uuid

from app.core.database import Base, GUID


CLIENT_PERMISSIONS = [
    "view_tickets",
    "create_tickets",
    "close_tickets",
    "view_reports",
    "manage_tenant_users",
    "create_issues",
]

DEFAULT_PERMISSIONS = {
    "CLIENT_ADMIN": {p: True for p in CLIENT_PERMISSIONS},
    "CLIENT_USER": {
        "view_tickets": True,
        "create_tickets": True,
        "close_tickets": False,
        "view_reports": False,
        "manage_tenant_users": False,
        "create_issues": False,
    }
}


class TenantPermission(Base):
    __tablename__ = "tenant_permissions"

    tenant_id: Mapped[uuid.UUID] = mapped_column(
        GUID(),
        ForeignKey("tenants.id", ondelete="CASCADE"),
        nullable=False,
    )
    user_id: Mapped[Optional[uuid.UUID]] = mapped_column(
        GUID(),
        ForeignKey("users.id", ondelete="CASCADE"),
        nullable=True,
    )
    role: Mapped[str] = mapped_column(String(50), nullable=False)
    permission: Mapped[str] = mapped_column(String(100), nullable=False)
    granted: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True)

    tenant: Mapped["Tenant"] = relationship("Tenant")
    user: Mapped[Optional["User"]] = relationship("User")

    __table_args__ = (
        UniqueConstraint(
            "tenant_id", "role", "user_id", "permission",
            name="uq_tenant_permission"
        ),
    )

    def __repr__(self) -> str:
        scope = f"user:{self.user_id}" if self.user_id else f"role:{self.role}"
        return f"<TenantPermission({scope} {self.permission}={'✓' if self.granted else '✗'})>"