admin / Synapse-Cortex

import uuid
from datetime import datetime
from typing import List, Optional

from pydantic import BaseModel, EmailStr, Field, field_validator

from .models import (
    ApprovalLevel,
    AssetSource,
    AssetStatus,
    RemediationRunStatus,
    TicketPriority,
    TicketSource,
    TicketStatus,
    TicketType,
    UserRole,
)
from .utils import is_valid_mac, normalize_mac


class LoginRequest(BaseModel):
    email: EmailStr
    password: str


class LoginMfaRequest(BaseModel):
    code: str = Field(..., min_length=6, max_length=6)


class MeOut(BaseModel):
    id: uuid.UUID
    tenant_id: uuid.UUID
    tenant_name: str
    email: str
    full_name: str
    role: UserRole
    is_active: bool
    mfa_enabled: bool
    mfa_required: bool
    ai_enabled: bool

    class Config:
        from_attributes = True


class SetupStatusOut(BaseModel):
    needs_setup: bool


class SetupRequest(BaseModel):
    tenant_name: str = Field(..., min_length=2, max_length=120)
    admin_full_name: str = Field(..., min_length=2, max_length=120)
    admin_email: EmailStr
    admin_password: str = Field(..., min_length=8)


class PasswordChangeRequest(BaseModel):
    current_password: str
    new_password: str = Field(..., min_length=8)


class MfaEnrollInitOut(BaseModel):
    qr_data_url: str
    secret: str


class MfaEnrollVerifyRequest(BaseModel):
    code: str = Field(..., min_length=6, max_length=6)


class MfaDisableRequest(BaseModel):
    current_password: str


class QueueCounts(BaseModel):
    unassigned: int
    awaiting_user: int
    sla_breaching: int
    resolved_today: int


class SLAPolicyOut(BaseModel):
    id: uuid.UUID
    tenant_id: uuid.UUID
    priority: TicketPriority
    response_time_minutes: int
    resolution_time_minutes: int

    class Config:
        from_attributes = True


class SLAPolicyUpdate(BaseModel):
    response_time_minutes: int = Field(..., gt=0)
    resolution_time_minutes: int = Field(..., gt=0)


class SoftwareItem(BaseModel):
    name: str
    version: Optional[str] = None


class AssetTypeOptionOut(BaseModel):
    id: uuid.UUID
    tenant_id: uuid.UUID
    name: str
    created_at: datetime

    class Config:
        from_attributes = True


class AssetTypeOptionCreate(BaseModel):
    name: str = Field(..., min_length=1, max_length=80)


class AssetTypeOptionUpdate(BaseModel):
    name: str = Field(..., min_length=1, max_length=80)


class AssetCreate(BaseModel):
    name: str = Field(..., min_length=2, max_length=120)
    asset_type_id: uuid.UUID
    mac_address: str
    ip_address: Optional[str] = None
    location: Optional[str] = None
    status: AssetStatus = AssetStatus.IN_STOCK
    assigned_to_id: Optional[uuid.UUID] = None

    @field_validator("mac_address")
    @classmethod
    def validate_mac(cls, value: str) -> str:
        if not is_valid_mac(value):
            raise ValueError("mac_address must be a valid MAC address (e.g. 00:1A:2B:3C:4D:5E)")
        return normalize_mac(value)


class AssetUpdate(BaseModel):
    """Partial update for the asset detail view's independently-editable sections."""

    name: Optional[str] = Field(None, min_length=2, max_length=120)
    asset_type_id: Optional[uuid.UUID] = None
    status: Optional[AssetStatus] = None
    location: Optional[str] = None
    assigned_to_id: Optional[uuid.UUID] = None
    mac_address: Optional[str] = None
    ip_address: Optional[str] = None
    os: Optional[str] = None
    software: Optional[List[SoftwareItem]] = None
    client_context: Optional[str] = Field(None, max_length=4000)

    @field_validator("mac_address")
    @classmethod
    def validate_mac(cls, value: Optional[str]) -> Optional[str]:
        if value is None or value == "":
            return None
        if not is_valid_mac(value):
            raise ValueError("mac_address must be a valid MAC address (e.g. 00:1A:2B:3C:4D:5E)")
        return normalize_mac(value)


class AssetOut(BaseModel):
    id: uuid.UUID
    tenant_id: uuid.UUID
    asset_id: str
    name: str
    asset_type_id: uuid.UUID
    asset_type_name: Optional[str] = None
    mac_address: Optional[str]
    ip_address: Optional[str]
    status: AssetStatus
    location: Optional[str]
    source: AssetSource
    os: Optional[str]
    software: Optional[List[SoftwareItem]]
    client_context: Optional[str] = None
    netscanxi_device_type: Optional[str]
    assigned_to_id: Optional[uuid.UUID]
    created_at: datetime

    class Config:
        from_attributes = True


class TicketCreate(BaseModel):
    title: str = Field(..., min_length=3, max_length=200)
    description: Optional[str] = None
    ticket_type: TicketType = TicketType.INCIDENT
    priority: TicketPriority = TicketPriority.MEDIUM
    asset_id: Optional[uuid.UUID] = None
    assigned_to_id: Optional[uuid.UUID] = None


class TicketUpdate(BaseModel):
    title: Optional[str] = Field(None, min_length=3, max_length=200)
    description: Optional[str] = None
    status: Optional[TicketStatus] = None
    assigned_to_id: Optional[uuid.UUID] = None
    priority: Optional[TicketPriority] = None
    credential_ref_id: Optional[uuid.UUID] = None


class TicketBulkDeleteRequest(BaseModel):
    ticket_ids: List[uuid.UUID] = Field(..., min_length=1)


class TicketOut(BaseModel):
    id: uuid.UUID
    tenant_id: uuid.UUID
    ticket_number: str
    title: str
    description: Optional[str]
    ticket_type: TicketType
    priority: TicketPriority
    status: TicketStatus
    requester_id: Optional[uuid.UUID]
    assigned_to_id: Optional[uuid.UUID]
    asset_id: Optional[uuid.UUID]
    credential_ref_id: Optional[uuid.UUID]
    response_due_at: Optional[datetime]
    resolution_due_at: Optional[datetime]
    resolved_at: Optional[datetime]
    source: TicketSource
    external_ref: Optional[str]
    created_at: datetime
    # Derived read-only fields sourced live from the linked Asset /
    # CredentialVaultEntry (see Ticket.asset_ip_address etc. in models.py) -
    # never stored on the ticket itself. credential_configured replaces
    # ever exposing the password, which no API response returns anywhere.
    asset_ip_address: Optional[str] = None
    credential_username: Optional[str] = None
    credential_configured: bool = False

    class Config:
        from_attributes = True


class DashboardOut(BaseModel):
    queue: QueueCounts
    tickets: List[TicketOut]


class TicketActionCreate(BaseModel):
    body: str = Field(..., min_length=1, max_length=4000)


class TicketActionOut(BaseModel):
    id: uuid.UUID
    tenant_id: uuid.UUID
    ticket_id: uuid.UUID
    user_id: Optional[uuid.UUID]
    user_name: Optional[str] = None
    body: str
    created_at: datetime

    class Config:
        from_attributes = True


class UserCreate(BaseModel):
    full_name: str = Field(..., min_length=2, max_length=120)
    email: EmailStr
    password: str = Field(..., min_length=8)
    role: UserRole = UserRole.REQUESTER


class UserUpdate(BaseModel):
    full_name: Optional[str] = Field(None, min_length=2, max_length=120)
    role: Optional[UserRole] = None
    is_active: Optional[bool] = None
    mfa_required: Optional[bool] = None


class UserOut(BaseModel):
    id: uuid.UUID
    tenant_id: uuid.UUID
    email: str
    full_name: str
    role: UserRole
    is_active: bool
    mfa_enabled: bool
    mfa_required: bool
    created_at: datetime

    class Config:
        from_attributes = True


class AuditLogOut(BaseModel):
    id: uuid.UUID
    tenant_id: uuid.UUID
    user_id: Optional[uuid.UUID]
    action: str
    detail: Optional[dict]
    ip_address: Optional[str]
    created_at: datetime

    class Config:
        from_attributes = True


class AuditLogListOut(BaseModel):
    logs: List[AuditLogOut]
    total: int
    page: int
    pages: int
    action_filter: Optional[str]
    all_actions: List[str]


class IngestAssetItem(BaseModel):
    """One device as reported by NetscanXi's scan/host dict."""

    asset_id: str
    mac: Optional[str] = None
    ip: Optional[str] = None
    hostname: Optional[str] = None
    device_type: Optional[str] = None
    os: Optional[str] = None
    software: Optional[List[SoftwareItem]] = None


class IngestRequest(BaseModel):
    assets: List[IngestAssetItem] = Field(default_factory=list)


class IngestTicketItem(BaseModel):
    """One remediation item as tracked by NetscanXi (its Remediation Tracking
    module), to be created as a Cortex ticket."""

    external_ref: str = Field(..., min_length=1)
    title: str = Field(..., min_length=1, max_length=200)
    description: Optional[str] = None
    priority: TicketPriority = TicketPriority.MEDIUM
    status: TicketStatus = TicketStatus.NEW
    asset_id: Optional[str] = None  # NetscanXi's asset_id string, resolved server-side


class IngestTicketsRequest(BaseModel):
    tickets: List[IngestTicketItem] = Field(default_factory=list)


# ---- AI Remediation Module --------------------------------------------------


class AiSettingsOut(BaseModel):
    ai_enabled: bool
    anthropic_key_configured: bool
    anthropic_key_last_test_ok: Optional[bool] = None
    anthropic_key_last_tested_at: Optional[datetime] = None


class AiSettingsUpdate(BaseModel):
    ai_enabled: bool


class AnthropicKeyUpdate(BaseModel):
    api_key: str = Field(..., min_length=10)


class AnthropicKeyTestRequest(BaseModel):
    # If omitted, tests the currently-saved key instead of an unsaved one.
    api_key: Optional[str] = Field(None, min_length=10)


class AnthropicKeyTestResult(BaseModel):
    ok: bool
    message: str


class VaultStatusOut(BaseModel):
    created: bool
    created_at: Optional[datetime] = None


class VaultCreateOut(BaseModel):
    created: bool
    created_at: datetime
    vault_key: str


class PlaybookCreate(BaseModel):
    name: str = Field(..., min_length=1, max_length=120)
    enabled: bool = True
    graph_json: dict = Field(default_factory=dict)
    allowed_target_os: List[str] = Field(default_factory=list)
    required_approval_level: ApprovalLevel = ApprovalLevel.HUMAN_IN_THE_LOOP
    forbidden_commands: List[str] = Field(default_factory=list)
    # Review-eligible baseline categories (e.g. "host_power") this playbook is
    # allowed to run behind mandatory human review instead of being auto-blocked.
    acknowledged_dangerous_commands: List[str] = Field(default_factory=list)


class PlaybookUpdate(BaseModel):
    name: Optional[str] = Field(None, min_length=1, max_length=120)
    enabled: Optional[bool] = None
    graph_json: Optional[dict] = None
    allowed_target_os: Optional[List[str]] = None
    required_approval_level: Optional[ApprovalLevel] = None
    forbidden_commands: Optional[List[str]] = None
    acknowledged_dangerous_commands: Optional[List[str]] = None


class PlaybookOut(BaseModel):
    id: uuid.UUID
    tenant_id: uuid.UUID
    name: str
    enabled: bool
    graph_json: dict
    allowed_target_os: List[str]
    required_approval_level: ApprovalLevel
    forbidden_commands: List[str]
    acknowledged_dangerous_commands: List[str] = Field(default_factory=list)
    created_by_id: Optional[uuid.UUID]
    created_at: datetime
    updated_at: datetime

    class Config:
        from_attributes = True


class PlaybookImportRequest(BaseModel):
    """Bulk import: the frontend normalizes an uploaded file (a single
    playbook object OR an array of them) into this wrapper before POSTing,
    so the on-disk file format authors work with can be either shape while
    the endpoint always receives a list. Each item reuses PlaybookCreate, so
    an exported playbook is a valid import item as-is."""

    playbooks: List[PlaybookCreate] = Field(..., min_length=1)


class PlaybookImportResultItem(BaseModel):
    name: str
    status: str  # "created" | "skipped" | "error"
    detail: Optional[str] = None
    id: Optional[uuid.UUID] = None


class PlaybookImportResult(BaseModel):
    created: int
    skipped: int
    errors: int
    results: List[PlaybookImportResultItem]


class CredentialCreate(BaseModel):
    label: str = Field(..., min_length=1, max_length=120)
    username: str = Field(..., min_length=1, max_length=120)
    # Optional when asset_id is set - the router derives host from the
    # asset's own recorded IP address instead of trusting a client-supplied
    # value, so the two can never silently drift apart. Required (validated
    # in the router) when asset_id is omitted, matching the original
    # free-form vaulting flow.
    host: Optional[str] = Field(None, max_length=255)
    port: int = Field(22, gt=0, le=65535)
    secret: str = Field(..., min_length=1)
    # Cross-reference key: at most one credential per (tenant, asset) - see
    # CredentialVaultEntry.asset_id. Lets a ticket linked to this asset
    # auto-match this credential instead of the agent re-entering it.
    asset_id: Optional[uuid.UUID] = None


class CredentialUpdate(BaseModel):
    label: Optional[str] = Field(None, min_length=1, max_length=120)
    username: Optional[str] = Field(None, min_length=1, max_length=120)
    host: Optional[str] = Field(None, min_length=1, max_length=255)
    port: Optional[int] = Field(None, gt=0, le=65535)
    secret: Optional[str] = Field(None, min_length=1)


class CredentialOut(BaseModel):
    """Never includes the secret or the encrypted blob - only a masked hint."""

    id: uuid.UUID
    tenant_id: uuid.UUID
    label: str
    username: str
    host: str
    port: int
    masked_hint: str
    asset_id: Optional[uuid.UUID]
    created_at: datetime

    class Config:
        from_attributes = True


class RemediationRunOut(BaseModel):
    id: uuid.UUID
    tenant_id: uuid.UUID
    ticket_id: uuid.UUID
    playbook_id: Optional[uuid.UUID]
    status: RemediationRunStatus
    ai_summary: Optional[str]
    proposed_plan: Optional[List[dict]]
    execution_log: Optional[List[dict]]
    outcome_summary: Optional[str]
    approved_by_id: Optional[uuid.UUID]
    approved_at: Optional[datetime]
    playbook_name_snapshot: Optional[str]
    guardrails_snapshot: Optional[dict]
    # For a command-runner run: the AI-proposed free-form command, shown as
    # the editable default on the approval card. Never the real secret.
    suggested_command: Optional[str] = None
    created_at: datetime
    updated_at: datetime

    class Config:
        from_attributes = True


class RemediationApproveRequest(BaseModel):
    # Only meaningful for a command-runner run: the final command to execute
    # (the approver may have edited the AI's suggestion). Omitted / null for a
    # normal playbook run, and ignored there. The supplied command is
    # re-checked by the full guardrail engine before it runs.
    command: Optional[str] = None