"""Pydantic schemas for authentication endpoints."""

from __future__ import annotations

from pydantic import BaseModel


class RegisterRequest(BaseModel):
    email: str
    password: str
    full_name: str
    phone: str | None = None
    # HARDENING.md P0.3: role is NOT client-controllable. Self-registration
    # always creates the least-privilege role; privileged roles are assigned
    # by an admin directly in the DB (or a future admin-gated endpoint).
    role: str = "CS Rep"  # kept for backward compat; ignored by the service


class LoginRequest(BaseModel):
    email: str
    password: str


class TokenResponse(BaseModel):
    access_token: str
    refresh_token: str
    token_type: str = "bearer"


class RefreshRequest(BaseModel):
    refresh_token: str


class UserOut(BaseModel):
    id: int
    email: str
    full_name: str
    phone: str | None
    role: str
    active: bool

    model_config = {"from_attributes": True}