from rest_framework import serializers

from .models import APIKey, Grant, Revoke, Role


class RoleSerializer(serializers.ModelSerializer):
    class Meta:
        model = Role
        fields = ["id", "name", "slug", "description", "permissions", "is_system", "users"]
        read_only_fields = ["id", "is_system"]


class GrantSerializer(serializers.ModelSerializer):
    class Meta:
        model = Grant
        fields = ["id", "user", "codename", "granted_by", "reason", "expires_at"]
        read_only_fields = ["id", "granted_by"]


class RevokeSerializer(serializers.ModelSerializer):
    class Meta:
        model = Revoke
        fields = ["id", "user", "codename", "revoked_by", "reason"]
        read_only_fields = ["id", "revoked_by"]


class APIKeySerializer(serializers.Serializer):
    id = serializers.IntegerField(read_only=True)
    name = serializers.CharField()
    prefix = serializers.CharField(read_only=True)
    key = serializers.CharField(read_only=True, help_text="Full secret, only shown once on creation")
    scopes = serializers.ListField(child=serializers.CharField(), default=list)
    is_active = serializers.BooleanField(default=True)
    expires_at = serializers.DateTimeField(allow_null=True, required=False)
    last_used_at = serializers.DateTimeField(read_only=True)

    def create(self, validated_data):
        return APIKey.objects.create(**validated_data)

    def update(self, instance, validated_data):
        for field, value in validated_data.items():
            setattr(instance, field, value)
        instance.save()
        return instance


class LoginSerializer(serializers.Serializer):
    username = serializers.CharField()
    password = serializers.CharField(write_only=True)


class TwoFactorSetupSerializer(serializers.Serializer):
    secret = serializers.CharField(read_only=True)
    qr_base64 = serializers.CharField(read_only=True)
    provisioning_uri = serializers.CharField(read_only=True)


class TwoFactorVerifySerializer(serializers.Serializer):
    code = serializers.CharField(max_length=10)
    secret = serializers.CharField(required=False)


class TwoFactorRecoverySerializer(serializers.Serializer):
    recovery_code = serializers.CharField()