"""
User model - Base for all users (patients and therapists)
HIPAA Compliance: Includes MFA support fields for enhanced authentication
"""
from sqlalchemy import Column, Integer, String, DateTime, Boolean, Enum
from sqlalchemy.sql import func
from config.database import Base
import enum

class UserRole(enum.Enum):
    PATIENT = "patient"
    THERAPIST = "therapist"
    ADMIN = "admin"

class User(Base):
    __tablename__ = "users"

    id = Column(Integer, primary_key=True, index=True)
    email = Column(String, unique=True, index=True, nullable=False)
    username = Column(String, unique=True, index=True, nullable=False)
    hashed_password = Column(String, nullable=False)

    # Profile info
    first_name = Column(String, nullable=False)
    last_name = Column(String, nullable=False)
    role = Column(Enum(UserRole), nullable=False, default=UserRole.PATIENT)
    phone_number = Column(String, nullable=True)

    # Account status
    is_active = Column(Boolean, default=True)
    is_verified = Column(Boolean, default=False)

    # Beta tester / Free access
    free_access_until = Column(DateTime(timezone=True), nullable=True)  # Null = no free access

    # Email verification
    email_verification_token = Column(String, nullable=True)
    email_verification_code = Column(String, nullable=True)  # 6-digit code for manual entry
    email_verified_at = Column(DateTime(timezone=True), nullable=True)
    verification_sent_at = Column(DateTime(timezone=True), nullable=True)

    # HIPAA Compliance: Multi-Factor Authentication (MFA) fields
    mfa_enabled = Column(Boolean, default=False)
    mfa_secret = Column(String, nullable=True)  # Encrypted TOTP secret
    mfa_backup_codes = Column(String, nullable=True)  # JSON array of backup codes (hashed)
    mfa_enabled_at = Column(DateTime(timezone=True), nullable=True)

    # Timestamps
    created_at = Column(DateTime(timezone=True), server_default=func.now())
    updated_at = Column(DateTime(timezone=True), onupdate=func.now())
    last_login = Column(DateTime(timezone=True))

    def __repr__(self):
        return f"<User {self.username} ({self.role.value})>"