import uuid
from datetime import datetime, timezone
from sqlalchemy import Column, String, Boolean, DateTime, ForeignKey, UniqueConstraint
from sqlalchemy.dialects.postgresql import UUID
from app.core.database import Base


def gen_uuid():
    return str(uuid.uuid4())


def now_utc():
    return datetime.now(timezone.utc)


class RoleMaster(Base):
    """A staff role (e.g. SALES_MGR). Referenced by login_users.role_code."""
    __tablename__ = 'role_master'
    role_id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    role_code = Column(String(50), unique=True, nullable=False)
    role_name = Column(String(150), nullable=False)
    description = Column(String(500))
    is_system_role = Column(Boolean, nullable=False, default=False)
    is_active = Column(Boolean, nullable=False, default=True)
    created_at = Column(DateTime(timezone=True), default=now_utc)


class ModuleMaster(Base):
    """A business module (e.g. SALES, INVENTORY). Toggling is_active disables it app-wide."""
    __tablename__ = 'module_master'
    module_id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    module_code = Column(String(50), unique=True, nullable=False)
    module_name = Column(String(150), nullable=False)
    description = Column(String(500))
    is_active = Column(Boolean, nullable=False, default=True)
    created_at = Column(DateTime(timezone=True), default=now_utc)


class RoleModulePermission(Base):
    """What a role can do in a module — the editable permission matrix."""
    __tablename__ = 'role_module_permission'
    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    role_code = Column(String(50), nullable=False)
    module_code = Column(String(50), nullable=False)
    can_view = Column(Boolean, nullable=False, default=False)
    can_create = Column(Boolean, nullable=False, default=False)
    can_edit = Column(Boolean, nullable=False, default=False)
    can_delete = Column(Boolean, nullable=False, default=False)
    can_approve = Column(Boolean, nullable=False, default=False)
    updated_at = Column(DateTime(timezone=True), default=now_utc, onupdate=now_utc)
    __table_args__ = (UniqueConstraint('role_code', 'module_code', name='uq_role_module'),)


class UserPermissionOverride(Base):
    """
    Per-user exception on top of their role, e.g. one manager gets extra rights
    without needing a whole new role. Flags left NULL fall back to the role's permission.
    """
    __tablename__ = 'user_permission_override'
    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    user_id = Column(UUID(as_uuid=True), ForeignKey('login_users.user_id'), nullable=False)
    module_code = Column(String(50), nullable=False)
    can_view = Column(Boolean, nullable=True)
    can_create = Column(Boolean, nullable=True)
    can_edit = Column(Boolean, nullable=True)
    can_delete = Column(Boolean, nullable=True)
    can_approve = Column(Boolean, nullable=True)
    granted_by = Column(UUID(as_uuid=True))
    granted_at = Column(DateTime(timezone=True), default=now_utc)
    note = Column(String(255))
    __table_args__ = (UniqueConstraint('user_id', 'module_code', name='uq_user_module_override'),)