"""Credential model - secrets stored Fernet-encrypted."""

from datetime import UTC, datetime

from sqlalchemy import DateTime, Enum, String, Text
from sqlalchemy.orm import Mapped, mapped_column

from app.core.database import Base

import enum


class CredentialType(str, enum.Enum):
    WINRM_USERPASS = "winrm_userpass"
    SSH_USERPASS = "ssh_userpass"
    SSH_KEY = "ssh_key"


class Credential(Base):
    __tablename__ = "credentials"

    id: Mapped[int] = mapped_column(primary_key=True)
    name: Mapped[str] = mapped_column(String(255), unique=True)
    type: Mapped[CredentialType] = mapped_column(Enum(CredentialType))

    username: Mapped[str] = mapped_column(String(255))
    # Encrypted at rest via core.security.encrypt()
    password_encrypted: Mapped[str | None] = mapped_column(Text, nullable=True)
    private_key_encrypted: Mapped[str | None] = mapped_column(Text, nullable=True)
    key_passphrase_encrypted: Mapped[str | None] = mapped_column(Text, nullable=True)

    created_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True), default=lambda: datetime.now(UTC)
    )
    updated_at: Mapped[datetime] = mapped_column(
        DateTime(timezone=True),
        default=lambda: datetime.now(UTC),
        onupdate=lambda: datetime.now(UTC),
    )