"""
TrustedDevice model — remember device functionality.

Maps to AGENT.md DBML: `trusted_devices` table (Lines 245-252).
"""
from django.conf import settings
from django.db import models

from core.models import BaseModel


class TrustedDevice(BaseModel):
    """
    Tracks devices that a user has approved as trusted.

    Trusted devices skip MFA challenges. `device_id` is a hashed identifier
    stored as a cookie on the client.
    """

    user = models.ForeignKey(
        settings.AUTH_USER_MODEL,
        on_delete=models.CASCADE,
        related_name="trusted_devices",
    )
    device_id = models.CharField(
        max_length=255,
        help_text="Hashed device identifier (stored as cookie on client).",
    )
    fingerprint = models.CharField(
        max_length=255,
        blank=True,
        default="",
        help_text="Device fingerprint for additional verification.",
    )
    last_used_at = models.DateTimeField(null=True, blank=True)
    approved = models.BooleanField(default=True)

    class Meta:
        db_table = "trusted_devices"
        constraints = [
            models.UniqueConstraint(
                fields=["user", "device_id"],
                name="unique_device_per_user",
            ),
        ]

    def __str__(self) -> str:
        return f"Device {self.device_id[:8]}... for {self.user_id}"