agent-platform/services/auth-service/app/schemas/auth.py

from datetime import datetime
from typing import TYPE_CHECKING

from pydantic import BaseModel, Field

from core_domain import (
    PermissionCheckContract,
    PermissionCheckResultContract,
    RoleAssignmentContract,
    RoleAssignmentStatus,
    RoleContract,
    RoleStatus,
    UserContract,
    UserStatus,
)
from core_shared import JSONValue

if TYPE_CHECKING:
    from app.db.models import Role, RoleAssignment, User


class UserCreateRequest(BaseModel):
    tenant_id: str
    username: str
    display_name: str | None = None
    email: str | None = None
    metadata_json: dict[str, JSONValue] = Field(default_factory=dict)


class UserStatusUpdateRequest(BaseModel):
    tenant_id: str
    status: UserStatus


class UserResponse(UserContract):
    @classmethod
    def from_entity(cls, entity: "User") -> "UserResponse":
        return cls.model_validate(entity, from_attributes=True)


class RoleCreateRequest(BaseModel):
    tenant_id: str
    code: str
    name: str
    description: str | None = None
    permissions_json: list[str] = Field(default_factory=list)


class RoleStatusUpdateRequest(BaseModel):
    tenant_id: str
    status: RoleStatus


class RoleResponse(RoleContract):
    @classmethod
    def from_entity(cls, entity: "Role") -> "RoleResponse":
        return cls.model_validate(entity, from_attributes=True)


class RoleAssignmentCreateRequest(BaseModel):
    tenant_id: str
    user_id: str
    role_id: str
    scope_type: str | None = None
    scope_id: str | None = None
    expires_time: datetime | None = None


class RoleAssignmentStatusUpdateRequest(BaseModel):
    tenant_id: str
    status: RoleAssignmentStatus


class RoleAssignmentResponse(RoleAssignmentContract):
    @classmethod
    def from_entity(cls, entity: "RoleAssignment") -> "RoleAssignmentResponse":
        return cls.model_validate(entity, from_attributes=True)


class PermissionCheckRequest(PermissionCheckContract):
    pass


class PermissionCheckResponse(PermissionCheckResultContract):
    pass