admin / Synapse-Cortex

import enum
import uuid
from datetime import datetime, timezone

from sqlalchemy import (
    Boolean,
    Column,
    DateTime,
    Enum,
    ForeignKey,
    Index,
    Integer,
    String,
    Text,
    UniqueConstraint,
    func,
    text,
)
from sqlalchemy.dialects.postgresql import JSON, UUID
from sqlalchemy.orm import relationship

from .database import Base


def _enum_column(enum_cls, name: str):
    """Enum column that persists the lowercase .value instead of the member name."""
    return Enum(enum_cls, name=name, values_callable=lambda e: [member.value for member in e])


class UserRole(str, enum.Enum):
    GLOBAL_ADMIN = "global_admin"
    TENANT_ADMIN = "tenant_admin"
    AGENT = "agent"
    REQUESTER = "requester"


class TicketType(str, enum.Enum):
    INCIDENT = "incident"
    REQUEST = "request"


class TicketPriority(str, enum.Enum):
    CRITICAL = "critical"
    HIGH = "high"
    MEDIUM = "medium"
    LOW = "low"


class TicketStatus(str, enum.Enum):
    NEW = "new"
    IN_PROGRESS = "in_progress"
    AWAITING_USER = "awaiting_user"
    RESOLVED = "resolved"
    CLOSED = "closed"


# Asset types used to be a fixed enum; they're now a tenant-editable table
# (AssetTypeOption below) so admins can rename/add/remove categories. These
# are only the names seeded into that table for every new tenant at setup -
# not a constraint on what values are allowed afterward.
DEFAULT_ASSET_TYPE_NAMES = (
    "Server",
    "Workstation",
    "Laptop",
    "Network Device",
    "Mobile",
    "Printer",
    "Other",
)


class AssetStatus(str, enum.Enum):
    IN_SERVICE = "in_service"
    IN_STOCK = "in_stock"
    IN_REPAIR = "in_repair"
    RETIRED = "retired"


class AssetSource(str, enum.Enum):
    MANUAL = "manual"
    NETSCANXI = "netscanxi"


class TicketSource(str, enum.Enum):
    MANUAL = "manual"
    NETSCANXI = "netscanxi"


class Tenant(Base):
    __tablename__ = "tenants"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    name = Column(String(120), unique=True, nullable=False)
    slug = Column(String(60), unique=True, nullable=False)
    created_at = Column(DateTime(timezone=True), server_default=func.now())

    users = relationship("User", back_populates="tenant", cascade="all, delete-orphan")
    assets = relationship("Asset", back_populates="tenant", cascade="all, delete-orphan")
    tickets = relationship("Ticket", back_populates="tenant", cascade="all, delete-orphan")
    sla_policies = relationship("SLAPolicy", back_populates="tenant", cascade="all, delete-orphan")


class User(Base):
    __tablename__ = "users"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    tenant_id = Column(UUID(as_uuid=True), ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False)
    email = Column(String(255), unique=True, nullable=False, index=True)
    full_name = Column(String(120), nullable=False)
    hashed_password = Column(String(255), nullable=False)
    role = Column(_enum_column(UserRole, "user_role"), nullable=False, default=UserRole.REQUESTER)
    is_active = Column(Boolean, nullable=False, default=True)
    mfa_enabled = Column(Boolean, nullable=False, default=False)
    mfa_secret = Column(String(32), nullable=True)
    mfa_required = Column(Boolean, nullable=False, default=False)
    created_at = Column(DateTime(timezone=True), server_default=func.now())

    tenant = relationship("Tenant", back_populates="users")
    assigned_tickets = relationship(
        "Ticket", foreign_keys="Ticket.assigned_to_id", back_populates="assigned_to"
    )
    requested_tickets = relationship(
        "Ticket", foreign_keys="Ticket.requester_id", back_populates="requester"
    )
    assets_assigned = relationship("Asset", back_populates="assigned_to")


class AssetTypeOption(Base):
    """Admin-managed asset category. Seeded with DEFAULT_ASSET_TYPE_NAMES for
    every new tenant, but fully editable afterward - rename, add, or delete
    (deletion is blocked at the DB level while any Asset still references
    it, via the plain FK on Asset.asset_type_id below)."""

    __tablename__ = "asset_type_options"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    tenant_id = Column(UUID(as_uuid=True), ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False)
    name = Column(String(80), nullable=False)
    created_at = Column(DateTime(timezone=True), server_default=func.now())

    tenant = relationship("Tenant")

    __table_args__ = (UniqueConstraint("tenant_id", "name", name="uq_asset_type_tenant_name"),)


class Asset(Base):
    __tablename__ = "assets"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    tenant_id = Column(UUID(as_uuid=True), ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False)
    asset_id = Column(String(32), unique=True, nullable=False, index=True)
    name = Column(String(120), nullable=False)
    asset_type_id = Column(UUID(as_uuid=True), ForeignKey("asset_type_options.id"), nullable=False)
    mac_address = Column(String(17), nullable=True)
    ip_address = Column(String(45), nullable=True)
    status = Column(_enum_column(AssetStatus, "asset_status"), nullable=False, default=AssetStatus.IN_STOCK)
    location = Column(String(120), nullable=True)
    source = Column(
        _enum_column(AssetSource, "asset_source"),
        nullable=False,
        default=AssetSource.MANUAL,
        server_default=text("'manual'"),
    )
    os = Column(String(120), nullable=True)
    software = Column(JSON, nullable=True)
    netscanxi_device_type = Column(String(60), nullable=True)
    assigned_to_id = Column(UUID(as_uuid=True), ForeignKey("users.id", ondelete="SET NULL"), nullable=True)
    created_at = Column(DateTime(timezone=True), server_default=func.now())
    updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now())

    tenant = relationship("Tenant", back_populates="assets")
    assigned_to = relationship("User", back_populates="assets_assigned")
    tickets = relationship("Ticket", back_populates="asset")
    asset_type_option = relationship("AssetTypeOption")

    @property
    def asset_type_name(self):
        return self.asset_type_option.name if self.asset_type_option else None

    __table_args__ = (
        # Partial unique index: enforce "no two assets share a MAC within a
        # tenant" only when a MAC is actually recorded, since NetscanXi also
        # reports IP-only devices with no MAC.
        Index(
            "uq_asset_tenant_mac",
            "tenant_id",
            "mac_address",
            unique=True,
            postgresql_where=mac_address.isnot(None),
        ),
    )


class SLAPolicy(Base):
    __tablename__ = "sla_policies"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    tenant_id = Column(UUID(as_uuid=True), ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False)
    priority = Column(_enum_column(TicketPriority, "ticket_priority"), nullable=False)
    response_time_minutes = Column(Integer, nullable=False)
    resolution_time_minutes = Column(Integer, nullable=False)
    created_at = Column(DateTime(timezone=True), server_default=func.now())

    tenant = relationship("Tenant", back_populates="sla_policies")

    __table_args__ = (
        UniqueConstraint("tenant_id", "priority", name="uq_sla_tenant_priority"),
    )


class Ticket(Base):
    __tablename__ = "tickets"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    tenant_id = Column(UUID(as_uuid=True), ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False)
    ticket_number = Column(String(20), nullable=False, index=True)
    title = Column(String(200), nullable=False)
    description = Column(Text, nullable=True)
    ticket_type = Column(_enum_column(TicketType, "ticket_type"), nullable=False, default=TicketType.INCIDENT)
    priority = Column(_enum_column(TicketPriority, "ticket_priority"), nullable=False, default=TicketPriority.MEDIUM)
    status = Column(_enum_column(TicketStatus, "ticket_status"), nullable=False, default=TicketStatus.NEW)
    requester_id = Column(UUID(as_uuid=True), ForeignKey("users.id", ondelete="SET NULL"), nullable=True)
    assigned_to_id = Column(UUID(as_uuid=True), ForeignKey("users.id", ondelete="SET NULL"), nullable=True)
    asset_id = Column(UUID(as_uuid=True), ForeignKey("assets.id", ondelete="SET NULL"), nullable=True)
    sla_policy_id = Column(UUID(as_uuid=True), ForeignKey("sla_policies.id", ondelete="SET NULL"), nullable=True)
    response_due_at = Column(DateTime(timezone=True), nullable=True)
    resolution_due_at = Column(DateTime(timezone=True), nullable=True)
    resolved_at = Column(DateTime(timezone=True), nullable=True)
    source = Column(
        _enum_column(TicketSource, "ticket_source"),
        nullable=False,
        default=TicketSource.MANUAL,
        server_default=text("'manual'"),
    )
    external_ref = Column(String(150), nullable=True)
    created_at = Column(DateTime(timezone=True), server_default=func.now())
    updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now())

    tenant = relationship("Tenant", back_populates="tickets")
    requester = relationship("User", foreign_keys=[requester_id], back_populates="requested_tickets")
    assigned_to = relationship("User", foreign_keys=[assigned_to_id], back_populates="assigned_tickets")
    asset = relationship("Asset", back_populates="tickets")
    sla_policy = relationship("SLAPolicy")

    __table_args__ = (
        UniqueConstraint("tenant_id", "ticket_number", name="uq_ticket_tenant_number"),
        # Partial unique index: dedupe key for auto-imported tickets (e.g. a
        # NetscanXi remediation item id) only enforced when actually set -
        # manually-created tickets never have one. Mirrors Asset.mac_address.
        Index(
            "uq_ticket_tenant_external_ref",
            "tenant_id",
            "external_ref",
            unique=True,
            postgresql_where=external_ref.isnot(None),
        ),
    )

    @property
    def is_sla_breaching(self) -> bool:
        if self.status in (TicketStatus.RESOLVED, TicketStatus.CLOSED):
            return False
        due_at = self.resolution_due_at
        if not due_at:
            return False
        if due_at.tzinfo is None:
            due_at = due_at.replace(tzinfo=timezone.utc)
        return datetime.now(timezone.utc) >= due_at


class TicketAction(Base):
    """A free-text action-taken entry an agent logs against a ticket -
    timestamped and attributed to whoever wrote it. Append-only: there is no
    edit/delete API for these, they're a record of what was actually done."""

    __tablename__ = "ticket_actions"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    tenant_id = Column(UUID(as_uuid=True), ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False)
    ticket_id = Column(UUID(as_uuid=True), ForeignKey("tickets.id", ondelete="CASCADE"), nullable=False)
    user_id = Column(UUID(as_uuid=True), ForeignKey("users.id", ondelete="SET NULL"), nullable=True)
    body = Column(Text, nullable=False)
    created_at = Column(DateTime(timezone=True), server_default=func.now())

    ticket = relationship("Ticket")
    user = relationship("User")

    __table_args__ = (Index("ix_ticket_actions_ticket_created", "ticket_id", "created_at"),)

    @property
    def user_name(self):
        return self.user.full_name if self.user else None


class IntegrationKey(Base):
    """A Cortex-issued API key that lets NetscanXi push asset data into the
    tenant's inbound ingest endpoint. One active row per tenant; regenerating
    overwrites/invalidates the previous key immediately."""

    __tablename__ = "integration_keys"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    tenant_id = Column(UUID(as_uuid=True), ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False, unique=True)
    key_hash = Column(String(64), nullable=False)
    enabled = Column(Boolean, nullable=False, default=True)
    created_at = Column(DateTime(timezone=True), server_default=func.now())
    last_used_at = Column(DateTime(timezone=True), nullable=True)
    created_by_id = Column(UUID(as_uuid=True), ForeignKey("users.id", ondelete="SET NULL"), nullable=True)

    tenant = relationship("Tenant")
    created_by = relationship("User")


class AuditLog(Base):
    __tablename__ = "audit_logs"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    tenant_id = Column(UUID(as_uuid=True), ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False)
    user_id = Column(UUID(as_uuid=True), ForeignKey("users.id", ondelete="SET NULL"), nullable=True)
    action = Column(String(60), nullable=False)
    detail = Column(JSON, nullable=True)
    ip_address = Column(String(45), nullable=True)
    created_at = Column(DateTime(timezone=True), server_default=func.now())

    tenant = relationship("Tenant")
    user = relationship("User")

    __table_args__ = (
        Index("ix_audit_tenant_created", "tenant_id", "created_at"),
        Index("ix_audit_tenant_action", "tenant_id", "action"),
    )