"""Plugin allowlist model — tracks authorized external plugins."""

from __future__ import annotations

import uuid

from sqlalchemy import Boolean, ForeignKey, String, Text
from sqlalchemy.dialects.postgresql import UUID as PGUUID
from sqlalchemy.orm import Mapped, mapped_column

from app.core.db import Base, TimestampMixin


class PluginAllowlist(Base, TimestampMixin):
    """Allowlist entry for an authorized external plugin.

    Only plugins whose hash or signature matches an allowlist entry
    can be installed from external sources.
    """

    __tablename__ = "plugin_allowlist"

    id: Mapped[uuid.UUID] = mapped_column(
        PGUUID(as_uuid=True), primary_key=True, default=uuid.uuid4
    )
    plugin_name: Mapped[str] = mapped_column(String(80), nullable=False, index=True)
    allowed_hash: Mapped[str | None] = mapped_column(String(64), nullable=True, index=True)
    allowed_signature: Mapped[str | None] = mapped_column(Text, nullable=True)
    public_key: Mapped[str | None] = mapped_column(Text, nullable=True)
    added_by: Mapped[uuid.UUID | None] = mapped_column(
        PGUUID(as_uuid=True), ForeignKey("users.id", ondelete="SET NULL"), nullable=True
    )
    is_active: Mapped[bool] = mapped_column(
        Boolean, nullable=False, default=True, server_default="true"
    )
    notes: Mapped[str | None] = mapped_column(Text, nullable=True)