from typing import List, Optional, Dict, Any
from pydantic import BaseModel, Field
from enum import Enum


class CapabilityTier(str, Enum):
    ADMIN = "admin"
    EDITOR = "editor"
    VIEWER = "viewer"


class UserSession(BaseModel):
    id: str
    username: str
    name: str
    email: Optional[str] = None
    auth_provider: str = "local" # "local" or "keycloak"
    raw_roles: List[str] = Field(default_factory=list)
    raw_groups: List[str] = Field(default_factory=list)
    capability: str = "viewer" # "admin", "editor", "viewer"
    can_edit: bool = False
    can_deploy: bool = False
    is_admin: bool = False
    is_readonly: bool = True


class LoginRequest(BaseModel):
    username: str
    password: str


class SSOCallbackRequest(BaseModel):
    code: str
    redirect_uri: str
    code_verifier: Optional[str] = None


class SSOTokenVerifyRequest(BaseModel):
    access_token: str


class TokenResponse(BaseModel):
    access_token: str
    token_type: str = "Bearer"
    expires_in: int = 86400
    user: UserSession


class RBACSettingsSchema(BaseModel):
    editor_roles: List[str] = Field(default_factory=list)
    editor_groups: List[str] = Field(default_factory=list)
    viewer_roles: List[str] = Field(default_factory=list)
    viewer_groups: List[str] = Field(default_factory=list)
    admin_roles: List[str] = Field(default_factory=list)
    admin_groups: List[str] = Field(default_factory=list)
    updated_at: Optional[str] = None
    updated_by: Optional[str] = None