"""InvitationToken — platform sign-up gate.

DISTINCT from Better Auth's `invitation` table:
- `invitation_token` (this file) gates creating a NEW account on the platform
  (the "new organization" sign-up path). Issued via the
  `backend/scripts/issue_invite.py` CLI.
- `invitation` (`auth_mirror.Invitation`) is BA's org-scoped invitation: lets
  an existing org admin invite someone to JOIN that org.

The sign-up `/sign-up?token=<token>` flow validates a row in this table and
atomically marks it used inside the same transaction as the user insert.
"""

import uuid
from datetime import datetime
from typing import Any, cast

from sqlalchemy import Column
from sqlalchemy.dialects.postgresql import TIMESTAMP, UUID
from sqlmodel import Field, SQLModel


def _ts_column(name: str, *, nullable: bool = False) -> Any:
    return Column(name, TIMESTAMP(timezone=True), nullable=nullable)


class InvitationToken(SQLModel, table=True):
    __tablename__ = cast(Any, "invitation_token")

    id: uuid.UUID = Field(
        default_factory=uuid.uuid4,
        sa_column=Column("id", UUID(as_uuid=True), primary_key=True),
    )
    token: str = Field(unique=True, nullable=False)
    email: str | None = Field(default=None, index=True)
    created_by: str | None = Field(
        default=None,
        foreign_key="user.id",
    )
    used_by: str | None = Field(
        default=None,
        foreign_key="user.id",
    )
    used_at: datetime | None = Field(
        default=None,
        sa_column=_ts_column("used_at", nullable=True),
    )
    expires_at: datetime = Field(sa_column=_ts_column("expires_at"))
    created_at: datetime = Field(sa_column=_ts_column("created_at"))