"""
RBAC administration schemas.
"""

from pydantic import BaseModel, Field


class PermissionDefinitionResponse(BaseModel):
    """System permission row exposed to the admin UI."""

    id: str
    code: str
    description: str
    is_active: bool = True


class PermissionToggleRequest(BaseModel):
    """Payload to toggle feature capability active state."""

    is_active: bool


class PermissionSyncResponse(BaseModel):
    """Result of permission definition sync with codebase enum."""

    synced: int
    added: int
    total: int
    codes: list[str]


class RoleResponse(BaseModel):
    """Staff or system role item."""

    id: str
    code: str
    name: str
    description: str | None = None
    is_system: bool = False
    user_count: int = 0
    permission_count: int = 0
    created_at: str | None = None


class RoleCreateRequest(BaseModel):
    """Payload to create a new custom role."""

    name: str = Field(..., min_length=2, max_length=100)
    code: str | None = Field(default=None, max_length=50, pattern=r"^[a-z0-9_]{2,50}$")
    description: str | None = Field(default=None, max_length=500)
    permissions: list[str] = Field(default_factory=list)


class RoleUpdateRequest(BaseModel):
    """Payload to update role metadata."""

    name: str | None = Field(default=None, min_length=2, max_length=100)
    description: str | None = Field(default=None, max_length=500)


class RolePermissionEntryResponse(BaseModel):
    """Permission grant state for a single role."""

    code: str
    description: str
    granted: bool


class RolePermissionsResponse(BaseModel):
    """Full permission matrix row set for one role."""

    role: str
    permissions: list[RolePermissionEntryResponse]


class RolePermissionUpdateItem(BaseModel):
    code: str = Field(..., min_length=3)
    granted: bool


class RolePermissionsUpdateRequest(BaseModel):
    permissions: list[RolePermissionUpdateItem] = Field(..., min_length=1)


class UserPermissionOverrideItem(BaseModel):
    code: str
    is_granted: bool


class UserPermissionOverridesUpdateRequest(BaseModel):
    overrides: list[UserPermissionOverrideItem]


class UserPermissionDetailResponse(BaseModel):
    user_id: str
    role: str
    effective_permissions: list[str]
    role_defaults: list[RolePermissionEntryResponse]
    overrides: list[UserPermissionOverrideItem]