from pydantic import BaseModel, field_validator

from app.domain import ALL_ROLES
from app.schemas.common import AppModel, UTCDateTime


class UserRef(AppModel):
    id: int
    display_name: str
    email: str


class UserOut(UserRef):
    employee_id: str | None = None
    is_active: bool
    roles: list[str]
    last_login_at: UTCDateTime | None = None


class MeOut(UserOut):
    auth_mode: str = "entra"


class RolesUpdateIn(BaseModel):
    roles: list[str]

    @field_validator("roles")
    @classmethod
    def _valid_roles(cls, v: list[str]) -> list[str]:
        unknown = set(v) - ALL_ROLES
        if unknown:
            raise ValueError(f"Unknown roles: {', '.join(sorted(unknown))}")
        return sorted(set(v))