using System.ComponentModel.DataAnnotations;

namespace Lagerbestand.Models;

public enum UserRole
{
    User = 0,
    Worker = 1,  // Changed from Owner - limited access to tire operations and inventory
    Admin = 2    // Full access to everything
}

public class AppUser
{
    [Key]
    public Guid Id { get; set; } = Guid.NewGuid();

    [Required]
    [MaxLength(100)]
    public string Username { get; set; } = string.Empty;

    [Required]
    [MaxLength(256)]
    public string PasswordHash { get; set; } = string.Empty;

    [MaxLength(200)]
    public string? DisplayName { get; set; }

    public UserRole Role { get; set; } = UserRole.User;

    public bool IsActive { get; set; } = true;

    public DateTime CreatedAt { get; set; } = DateTime.UtcNow;

    public DateTime? LastLoginAt { get; set; }

    /// <summary>
    /// Whether 2FA is enabled for this user (user opted in or admin enforced).
    /// </summary>
    public bool TwoFactorEnabled { get; set; }

    /// <summary>
    /// Base32-encoded TOTP secret key for authenticator apps.
    /// </summary>
    [MaxLength(256)]
    public string? TwoFactorSecret { get; set; }

    /// <summary>
    /// Whether an admin has enforced 2FA for this user.
    /// When true, the user cannot disable 2FA themselves.
    /// </summary>
    public bool TwoFactorEnforced { get; set; }
}