"""
Pydantic-Schemas fuer alle API-Eingaben/-Ausgaben.

Strikte Validierung ist Teil des Hardening-Konzepts (6.6): Laenge, Typ und
erlaubte Zeichen werden hier durchgesetzt, bevor irgendein Wert die
Business-Logik oder die Datenbank erreicht.
"""
from __future__ import annotations

import re
from typing import Literal

from pydantic import BaseModel, Field, field_validator

USERNAME_RE = re.compile(r"^[a-zA-Z0-9._-]{3,64}$")
HOSTNAME_LABEL_RE = re.compile(r"^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$")


class LoginRequest(BaseModel):
    username: str = Field(min_length=3, max_length=64)
    password: str = Field(min_length=1, max_length=256)

    @field_validator("username")
    @classmethod
    def check_username(cls, v: str) -> str:
        if not USERNAME_RE.match(v):
            raise ValueError("Ungueltiger Benutzername")
        return v


class TotpLoginRequest(BaseModel):
    pending_token: str
    code: str = Field(min_length=6, max_length=64)


class TotpConfirmRequest(BaseModel):
    code: str = Field(min_length=6, max_length=6, pattern=r"^\d{6}$")


class ChangePasswordRequest(BaseModel):
    current_password: str = Field(min_length=1, max_length=256)
    new_password: str = Field(min_length=12, max_length=256)


class UserCreateRequest(BaseModel):
    username: str = Field(min_length=3, max_length=64)
    initial_password: str = Field(min_length=12, max_length=256)
    is_admin: bool = False

    @field_validator("username")
    @classmethod
    def check_username(cls, v: str) -> str:
        if not USERNAME_RE.match(v):
            raise ValueError("Ungueltiger Benutzername")
        return v


class HostGroupCreateRequest(BaseModel):
    name: str = Field(min_length=1, max_length=128)
    description: str | None = Field(default=None, max_length=1024)


class HostCreateRequest(BaseModel):
    host_group_id: int
    hostname: str = Field(min_length=1, max_length=128)
    address: str = Field(min_length=1, max_length=255)
    protocol: Literal["ssh", "rdp"]
    port: int = Field(gt=0, le=65535)
    os_type: Literal["linux", "windows"]
    ssh_host_key_fingerprint: str | None = Field(default=None, max_length=512)
    ssh_username: str | None = Field(default=None, max_length=128)
    rdp_username: str | None = Field(default=None, max_length=128)
    rdp_domain: str | None = Field(default=None, max_length=128)
    rdp_require_nla: bool = True
    clipboard_enabled: bool = True
    file_transfer_enabled: bool = True

    @field_validator("hostname")
    @classmethod
    def check_hostname(cls, v: str) -> str:
        if not HOSTNAME_LABEL_RE.match(v):
            raise ValueError("Ungueltiger Hostname")
        return v


class RoleGrantRequest(BaseModel):
    user_id: int
    host_group_id: int
    role_name: Literal[
        "ssh_connect", "rdp_connect", "file_transfer", "clipboard",
        "session_recording_view", "admin_hostgroup",
    ]
    expires_at: str | None = None


class SshKeyCreateRequest(BaseModel):
    label: str = Field(min_length=1, max_length=128)
    owner_user_id: int | None = None
    private_key_pem: str = Field(min_length=1, max_length=32_768)
    public_key: str = Field(min_length=1, max_length=8192)
    key_type: Literal["ed25519", "rsa-3072", "rsa-4096", "ca-cert"]


class ConnectRequest(BaseModel):
    host_id: int


class RdpCredentialsRequest(BaseModel):
    password: str = Field(min_length=1, max_length=512)