from __future__ import annotations

from datetime import datetime
from typing import Any, Literal

from pydantic import Field
from pydantic import BaseModel


AuditDetailLevel = Literal["summary", "standard", "full"]


class OrganizationIdentityCandidate(BaseModel):
    id: str
    display_name: str | None = None
    external_subject: str | None = None
    source: str
    primary_account_id: str | None = None
    account_ids: list[str]
    status: str


class OrganizationIdentityCandidateList(BaseModel):
    identities: list[OrganizationIdentityCandidate]


class OrganizationFunctionAssignmentItem(BaseModel):
    id: str
    tenant_id: str
    identity_id: str
    account_id: str | None = None
    function_id: str
    organization_unit_id: str
    applies_to_subunits: bool
    source: str
    delegated_from_assignment_id: str | None = None
    acting_for_account_id: str | None = None
    valid_from: datetime | None = None
    valid_until: datetime | None = None
    expired_event_at: datetime | None = None
    is_active: bool
    settings: dict[str, Any]
    created_at: datetime
    updated_at: datetime


class OrganizationFunctionAssignmentList(BaseModel):
    assignments: list[OrganizationFunctionAssignmentItem]
    total: int = 0
    page: int = 1
    page_size: int = 500
    pages: int = 1


class OrganizationFunctionAssignmentCreateRequest(BaseModel):
    identity_id: str = Field(min_length=1)
    function_id: str = Field(min_length=1)
    account_id: str | None = None
    applies_to_subunits: bool = False
    source: str = "direct"
    delegated_from_assignment_id: str | None = None
    acting_for_account_id: str | None = None
    valid_from: datetime | None = None
    valid_until: datetime | None = None
    is_active: bool = True
    settings: dict[str, Any] = Field(default_factory=dict)
    change_request_id: str | None = None
    governance_override_reason: str | None = Field(default=None, max_length=4_000)
    governance_override_evidence: list[str] = Field(
        default_factory=list, max_length=100
    )


class OrganizationFunctionAssignmentUpdateRequest(BaseModel):
    identity_id: str | None = None
    function_id: str | None = None
    account_id: str | None = None
    applies_to_subunits: bool | None = None
    source: str | None = None
    delegated_from_assignment_id: str | None = None
    acting_for_account_id: str | None = None
    valid_from: datetime | None = None
    valid_until: datetime | None = None
    is_active: bool | None = None
    settings: dict[str, Any] | None = None
    change_request_id: str | None = None
    governance_override_reason: str | None = Field(default=None, max_length=4_000)
    governance_override_evidence: list[str] = Field(
        default_factory=list, max_length=100
    )


class IdmSettingsItem(BaseModel):
    tenant_id: str
    require_assignment_change_requests: bool
    audit_detail_level: AuditDetailLevel
    change_retention_days: int | None = None
    settings: dict[str, Any]
    created_at: datetime | None = None
    updated_at: datetime | None = None


class IdmSettingsUpdateRequest(BaseModel):
    require_assignment_change_requests: bool | None = None
    audit_detail_level: AuditDetailLevel | None = None
    change_retention_days: int | None = Field(default=None, ge=0)
    settings: dict[str, Any] | None = None


class TypedGroupItem(BaseModel):
    id: str
    tenant_id: str
    key: str
    name: str
    group_type: str
    description: str | None = None
    status: Literal["active", "inactive"]
    source_provider: str
    source_resource_type: str | None = None
    source_resource_id: str | None = None
    source_revision: str | None = None
    properties: dict[str, Any]
    provenance: dict[str, Any]
    revision: int
    created_at: datetime | None = None
    updated_at: datetime | None = None


class TypedGroupList(BaseModel):
    groups: list[TypedGroupItem]
    total: int


class TypedGroupCreateRequest(BaseModel):
    key: str = Field(min_length=1, max_length=120)
    name: str = Field(min_length=1, max_length=255)
    group_type: str = Field(min_length=1, max_length=80)
    description: str | None = Field(default=None, max_length=8_000)
    source_provider: str = Field(default="local", min_length=1, max_length=80)
    source_resource_type: str | None = Field(default=None, max_length=120)
    source_resource_id: str | None = Field(default=None, max_length=255)
    source_revision: str | None = Field(default=None, max_length=255)
    properties: dict[str, Any] = Field(default_factory=dict)
    provenance: dict[str, Any] = Field(default_factory=dict)


class TypedGroupUpdateRequest(BaseModel):
    base_revision: int = Field(ge=1)
    key: str | None = Field(default=None, min_length=1, max_length=120)
    name: str | None = Field(default=None, min_length=1, max_length=255)
    group_type: str | None = Field(default=None, min_length=1, max_length=80)
    description: str | None = Field(default=None, max_length=8_000)
    status: Literal["active", "inactive"] | None = None
    source_provider: str | None = Field(default=None, min_length=1, max_length=80)
    source_resource_type: str | None = Field(default=None, max_length=120)
    source_resource_id: str | None = Field(default=None, max_length=255)
    source_revision: str | None = Field(default=None, max_length=255)
    properties: dict[str, Any] | None = None
    provenance: dict[str, Any] | None = None


class IdentityRelationshipItem(BaseModel):
    id: str
    tenant_id: str
    relationship_kind: str
    subject_identity_id: str
    target_group_id: str | None = None
    related_identity_id: str | None = None
    role: str | None = None
    valid_from: datetime | None = None
    valid_until: datetime | None = None
    status: Literal["active", "revoked"]
    revoked_at: datetime | None = None
    revoked_by: str | None = None
    revocation_reason: str | None = None
    expired_event_at: datetime | None = None
    source_provider: str
    source_resource_type: str | None = None
    source_resource_id: str | None = None
    source_revision: str | None = None
    properties: dict[str, Any]
    provenance: dict[str, Any]
    revision: int
    created_at: datetime | None = None
    updated_at: datetime | None = None


class IdentityRelationshipList(BaseModel):
    relationships: list[IdentityRelationshipItem]
    total: int


class IdentityRelationshipCreateRequest(BaseModel):
    relationship_kind: str = Field(min_length=1, max_length=80)
    subject_identity_id: str = Field(min_length=1, max_length=36)
    target_group_id: str | None = Field(default=None, max_length=36)
    related_identity_id: str | None = Field(default=None, max_length=36)
    role: str | None = Field(default=None, max_length=120)
    valid_from: datetime | None = None
    valid_until: datetime | None = None
    source_provider: str = Field(default="local", min_length=1, max_length=80)
    source_resource_type: str | None = Field(default=None, max_length=120)
    source_resource_id: str | None = Field(default=None, max_length=255)
    source_revision: str | None = Field(default=None, max_length=255)
    properties: dict[str, Any] = Field(default_factory=dict)
    provenance: dict[str, Any] = Field(default_factory=dict)


class IdentityRelationshipUpdateRequest(BaseModel):
    base_revision: int = Field(ge=1)
    relationship_kind: str | None = Field(default=None, min_length=1, max_length=80)
    target_group_id: str | None = Field(default=None, max_length=36)
    related_identity_id: str | None = Field(default=None, max_length=36)
    role: str | None = Field(default=None, max_length=120)
    valid_from: datetime | None = None
    valid_until: datetime | None = None
    source_provider: str | None = Field(default=None, min_length=1, max_length=80)
    source_resource_type: str | None = Field(default=None, max_length=120)
    source_resource_id: str | None = Field(default=None, max_length=255)
    source_revision: str | None = Field(default=None, max_length=255)
    properties: dict[str, Any] | None = None
    provenance: dict[str, Any] | None = None


class IdentityRelationshipRevokeRequest(BaseModel):
    base_revision: int = Field(ge=1)
    reason: str = Field(min_length=1, max_length=8_000)


class IdentityRelationshipDecisionItem(BaseModel):
    relationship: IdentityRelationshipItem
    included: bool
    code: str
    explanation: str
    identity_status: str | None = None


class TypedGroupMembershipResolutionItem(BaseModel):
    group: TypedGroupItem
    effective_at: datetime
    decisions: list[IdentityRelationshipDecisionItem]
    identity_ids: list[str]


FunctionAssignmentChangeKind = Literal["request", "grant"]
FunctionAssignmentChangeAction = Literal[
    "approve",
    "reject",
    "accept",
    "request_changes",
    "respond",
    "withdraw",
    "recover",
]


class FunctionAssignmentChangeCreateRequest(BaseModel):
    kind: FunctionAssignmentChangeKind
    function_id: str = Field(min_length=1, max_length=36)
    candidate_identity_id: str = Field(min_length=1, max_length=36)
    candidate_account_id: str | None = Field(default=None, max_length=36)
    justification: str = Field(min_length=1, max_length=8_000)
    evidence: list[str] = Field(default_factory=list, max_length=100)
    requested_valid_from: datetime | None = None
    requested_valid_until: datetime | None = None
    applies_to_subunits: bool = False
    assignment_source: Literal["governance", "delegated"] = "governance"
    represented_assignment_id: str | None = Field(default=None, max_length=36)
    idempotency_key: str = Field(min_length=1, max_length=255)
    metadata: dict[str, Any] = Field(default_factory=dict)


class FunctionAssignmentChangeActionRequest(BaseModel):
    action: FunctionAssignmentChangeAction
    base_revision: int = Field(ge=1)
    comment: str | None = Field(default=None, max_length=4_000)
    evidence: list[str] = Field(default_factory=list, max_length=100)


class FunctionAssignmentChangeEventItem(BaseModel):
    id: str
    sequence: int
    action: str
    from_state: str | None = None
    to_state: str
    actor_account_id: str | None = None
    actor_identity_id: str | None = None
    actor_assignment_id: str | None = None
    comment: str | None = None
    evidence: list[str]
    policy_decision: dict[str, Any]
    workflow_step_id: str | None = None
    details: dict[str, Any]
    created_at: datetime


class FunctionAssignmentChangeItem(BaseModel):
    id: str
    tenant_id: str
    kind: FunctionAssignmentChangeKind
    state: str
    profile: str
    function_id: str
    organization_unit_id: str
    candidate_identity_id: str
    candidate_account_id: str | None = None
    initiator_account_id: str
    initiator_identity_id: str | None = None
    represented_assignment_id: str | None = None
    justification: str
    evidence: list[str]
    requested_valid_from: datetime | None = None
    requested_valid_until: datetime | None = None
    applies_to_subunits: bool
    assignment_source: str
    required_steps: list[str]
    completed_steps: list[str]
    policy_decision: dict[str, Any]
    workflow_definition_id: str | None = None
    workflow_definition_revision_id: str | None = None
    workflow_definition_revision: int | None = None
    workflow_definition_hash: str | None = None
    workflow_instance_id: str | None = None
    workflow_current_step_id: str | None = None
    resulting_assignment_id: str | None = None
    expires_at: datetime | None = None
    outcome_reason: str | None = None
    resource_revision: int
    etag: str
    metadata: dict[str, Any]
    events: list[FunctionAssignmentChangeEventItem] = Field(default_factory=list)
    available_actions: list[str] = Field(default_factory=list)
    availability_reason: str | None = None
    created_at: datetime
    updated_at: datetime


class FunctionAssignmentChangeList(BaseModel):
    changes: list[FunctionAssignmentChangeItem]
    total: int
    page: int
    page_size: int
    pages: int


class FunctionAssignmentCapabilityItem(BaseModel):
    kind: FunctionAssignmentChangeKind
    function_id: str
    available: bool
    reason: str | None = None
    profile: str = "unavailable"
    required_steps: list[str] = Field(default_factory=list)
    requirements: list[str] = Field(default_factory=list)
    authority_function_id: str | None = None
    evidence_required: bool = False
    recipient_acceptance_required: bool = False
    maximum_validity_days: int | None = None
    workflow_available: bool = False
    policy_available: bool = False