"""
RefreshToken model — tracks token rotation chain.

Maps to AGENT.md DBML: `refresh_tokens` table (Lines 202-209).
"""
from django.conf import settings
from django.db import models
from django.utils import timezone

from core.models import BaseModel


class RefreshToken(BaseModel):
    """
    Refresh token with rotation tracking.

    Each rotation creates a new token linked to its parent via `rotated_from`.
    Detects token reuse attacks by checking if a revoked token is used again.
    """

    user = models.ForeignKey(
        settings.AUTH_USER_MODEL,
        on_delete=models.CASCADE,
        related_name="refresh_tokens",
    )
    rotated_from = models.UUIDField(
        null=True,
        blank=True,
        help_text="Parent token ID this was rotated from.",
    )
    expires_at = models.DateTimeField()
    revoked_at = models.DateTimeField(null=True, blank=True)

    class Meta:
        db_table = "refresh_tokens"
        ordering = ["-created_at"]
        indexes = [
            models.Index(fields=["user", "-created_at"]),
        ]

    def __str__(self) -> str:
        return f"RefreshToken {self.pk} for {self.user_id}"

    @property
    def is_active(self) -> bool:
        return self.revoked_at is None and self.expires_at > timezone.now()

    def revoke(self) -> None:
        self.revoked_at = timezone.now()
        self.save(update_fields=["revoked_at"])