orchard/backend/app/models.py

from datetime import datetime
from sqlalchemy import (
    Column,
    String,
    Text,
    Boolean,
    Integer,
    BigInteger,
    DateTime,
    ForeignKey,
    CheckConstraint,
    Index,
    JSON,
    ARRAY,
)
from sqlalchemy.dialects.postgresql import UUID
from sqlalchemy.orm import relationship, declarative_base
import uuid

Base = declarative_base()


class Project(Base):
    __tablename__ = "projects"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    name = Column(String(255), unique=True, nullable=False)
    description = Column(Text)
    is_public = Column(Boolean, default=True)
    created_at = Column(DateTime(timezone=True), default=datetime.utcnow)
    updated_at = Column(
        DateTime(timezone=True), default=datetime.utcnow, onupdate=datetime.utcnow
    )
    created_by = Column(String(255), nullable=False)

    packages = relationship(
        "Package", back_populates="project", cascade="all, delete-orphan"
    )
    permissions = relationship(
        "AccessPermission", back_populates="project", cascade="all, delete-orphan"
    )

    __table_args__ = (
        Index("idx_projects_name", "name"),
        Index("idx_projects_created_by", "created_by"),
    )


class Package(Base):
    __tablename__ = "packages"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    project_id = Column(
        UUID(as_uuid=True),
        ForeignKey("projects.id", ondelete="CASCADE"),
        nullable=False,
    )
    name = Column(String(255), nullable=False)
    description = Column(Text)
    format = Column(String(50), default="generic", nullable=False)
    platform = Column(String(50), default="any", nullable=False)
    created_at = Column(DateTime(timezone=True), default=datetime.utcnow)
    updated_at = Column(
        DateTime(timezone=True), default=datetime.utcnow, onupdate=datetime.utcnow
    )

    project = relationship("Project", back_populates="packages")
    tags = relationship("Tag", back_populates="package", cascade="all, delete-orphan")
    uploads = relationship(
        "Upload", back_populates="package", cascade="all, delete-orphan"
    )
    consumers = relationship(
        "Consumer", back_populates="package", cascade="all, delete-orphan"
    )
    versions = relationship(
        "PackageVersion", back_populates="package", cascade="all, delete-orphan"
    )

    __table_args__ = (
        Index("idx_packages_project_id", "project_id"),
        Index("idx_packages_name", "name"),
        Index("idx_packages_format", "format"),
        Index("idx_packages_platform", "platform"),
        Index(
            "idx_packages_project_name", "project_id", "name", unique=True
        ),  # Composite unique index
        CheckConstraint(
            "format IN ('generic', 'npm', 'pypi', 'docker', 'deb', 'rpm', 'maven', 'nuget', 'helm')",
            name="check_package_format",
        ),
        CheckConstraint(
            "platform IN ('any', 'linux', 'darwin', 'windows', 'linux-amd64', 'linux-arm64', 'darwin-amd64', 'darwin-arm64', 'windows-amd64')",
            name="check_package_platform",
        ),
        {"extend_existing": True},
    )


class Artifact(Base):
    __tablename__ = "artifacts"

    id = Column(String(64), primary_key=True)  # SHA256 hash
    size = Column(BigInteger, nullable=False)
    content_type = Column(String(255))
    original_name = Column(String(1024))
    checksum_md5 = Column(String(32))  # MD5 hash for additional verification
    checksum_sha1 = Column(String(40))  # SHA1 hash for compatibility
    s3_etag = Column(String(64))  # S3 ETag for verification
    artifact_metadata = Column(
        "metadata", JSON, default=dict
    )  # Format-specific metadata (column name is 'metadata')
    created_at = Column(DateTime(timezone=True), default=datetime.utcnow)
    created_by = Column(String(255), nullable=False)
    ref_count = Column(Integer, default=1)
    s3_key = Column(String(1024), nullable=False)

    tags = relationship("Tag", back_populates="artifact")
    uploads = relationship("Upload", back_populates="artifact")
    versions = relationship("PackageVersion", back_populates="artifact")
    dependencies = relationship(
        "ArtifactDependency", back_populates="artifact", cascade="all, delete-orphan"
    )

    @property
    def sha256(self) -> str:
        """Alias for id - the SHA256 hash of the artifact content"""
        return self.id

    @property
    def format_metadata(self):
        """Alias for artifact_metadata - backward compatibility"""
        return self.artifact_metadata

    @format_metadata.setter
    def format_metadata(self, value):
        """Alias setter for artifact_metadata - backward compatibility"""
        self.artifact_metadata = value

    __table_args__ = (
        Index("idx_artifacts_created_at", "created_at"),
        Index("idx_artifacts_created_by", "created_by"),
        Index("idx_artifacts_ref_count", "ref_count"),  # For cleanup queries
        CheckConstraint("ref_count >= 0", name="check_ref_count_non_negative"),
        CheckConstraint("size > 0", name="check_size_positive"),
    )


class Tag(Base):
    __tablename__ = "tags"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    package_id = Column(
        UUID(as_uuid=True),
        ForeignKey("packages.id", ondelete="CASCADE"),
        nullable=False,
    )
    name = Column(String(255), nullable=False)
    artifact_id = Column(String(64), ForeignKey("artifacts.id"), nullable=False)
    created_at = Column(DateTime(timezone=True), default=datetime.utcnow)
    updated_at = Column(
        DateTime(timezone=True), default=datetime.utcnow, onupdate=datetime.utcnow
    )
    created_by = Column(String(255), nullable=False)

    package = relationship("Package", back_populates="tags")
    artifact = relationship("Artifact", back_populates="tags")
    history = relationship(
        "TagHistory", back_populates="tag", cascade="all, delete-orphan"
    )

    __table_args__ = (
        Index("idx_tags_package_id", "package_id"),
        Index("idx_tags_artifact_id", "artifact_id"),
        Index(
            "idx_tags_package_name", "package_id", "name", unique=True
        ),  # Composite unique index
        Index(
            "idx_tags_package_created_at", "package_id", "created_at"
        ),  # For recent tags queries
    )


class TagHistory(Base):
    __tablename__ = "tag_history"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    tag_id = Column(
        UUID(as_uuid=True), ForeignKey("tags.id", ondelete="CASCADE"), nullable=False
    )
    old_artifact_id = Column(String(64), ForeignKey("artifacts.id"))
    new_artifact_id = Column(String(64), ForeignKey("artifacts.id"), nullable=False)
    change_type = Column(String(20), nullable=False, default="update")
    changed_at = Column(DateTime(timezone=True), default=datetime.utcnow)
    changed_by = Column(String(255), nullable=False)

    tag = relationship("Tag", back_populates="history")

    __table_args__ = (
        Index("idx_tag_history_tag_id", "tag_id"),
        Index("idx_tag_history_changed_at", "changed_at"),
        CheckConstraint(
            "change_type IN ('create', 'update', 'delete')", name="check_change_type"
        ),
    )


class PackageVersion(Base):
    """Immutable version record for a package-artifact relationship.

    Separates versions (immutable, set at upload) from tags (mutable labels).
    Each artifact in a package can have at most one version.
    """

    __tablename__ = "package_versions"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    package_id = Column(
        UUID(as_uuid=True),
        ForeignKey("packages.id", ondelete="CASCADE"),
        nullable=False,
    )
    artifact_id = Column(String(64), ForeignKey("artifacts.id"), nullable=False)
    version = Column(String(255), nullable=False)
    version_source = Column(String(50))  # 'explicit', 'filename', 'metadata', 'migrated_from_tag'
    created_at = Column(DateTime(timezone=True), default=datetime.utcnow)
    created_by = Column(String(255), nullable=False)

    package = relationship("Package", back_populates="versions")
    artifact = relationship("Artifact", back_populates="versions")

    __table_args__ = (
        Index("idx_package_versions_package_id", "package_id"),
        Index("idx_package_versions_artifact_id", "artifact_id"),
        Index("idx_package_versions_package_version", "package_id", "version", unique=True),
        Index("idx_package_versions_package_artifact", "package_id", "artifact_id", unique=True),
    )


class Upload(Base):
    __tablename__ = "uploads"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    artifact_id = Column(String(64), ForeignKey("artifacts.id"), nullable=False)
    package_id = Column(UUID(as_uuid=True), ForeignKey("packages.id"), nullable=False)
    original_name = Column(String(1024))
    tag_name = Column(String(255))  # Tag assigned during upload
    user_agent = Column(String(512))  # Client identification
    duration_ms = Column(Integer)  # Upload timing in milliseconds
    deduplicated = Column(Boolean, default=False)  # Whether artifact was deduplicated
    checksum_verified = Column(Boolean, default=True)  # Whether checksum was verified
    status = Column(
        String(20), default="completed", nullable=False
    )  # pending, completed, failed
    error_message = Column(Text)  # Error details for failed uploads
    client_checksum = Column(String(64))  # Client-provided SHA256 for verification
    uploaded_at = Column(DateTime(timezone=True), default=datetime.utcnow)
    uploaded_by = Column(String(255), nullable=False)
    source_ip = Column(String(45))

    artifact = relationship("Artifact", back_populates="uploads")
    package = relationship("Package", back_populates="uploads")

    __table_args__ = (
        Index("idx_uploads_artifact_id", "artifact_id"),
        Index("idx_uploads_package_id", "package_id"),
        Index("idx_uploads_uploaded_at", "uploaded_at"),
        Index("idx_uploads_package_uploaded_at", "package_id", "uploaded_at"),
        Index("idx_uploads_uploaded_by_at", "uploaded_by", "uploaded_at"),
        Index("idx_uploads_status", "status"),
        Index("idx_uploads_status_uploaded_at", "status", "uploaded_at"),
        CheckConstraint(
            "status IN ('pending', 'completed', 'failed')", name="check_upload_status"
        ),
    )


class UploadLock(Base):
    """Track in-progress uploads for conflict detection (409 responses)."""

    __tablename__ = "upload_locks"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    sha256_hash = Column(String(64), nullable=False)
    package_id = Column(
        UUID(as_uuid=True),
        ForeignKey("packages.id", ondelete="CASCADE"),
        nullable=False,
    )
    locked_at = Column(DateTime(timezone=True), default=datetime.utcnow)
    locked_by = Column(String(255), nullable=False)
    expires_at = Column(DateTime(timezone=True), nullable=False)

    __table_args__ = (
        Index("idx_upload_locks_expires_at", "expires_at"),
        Index(
            "idx_upload_locks_hash_package", "sha256_hash", "package_id", unique=True
        ),
    )


class Consumer(Base):
    __tablename__ = "consumers"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    package_id = Column(
        UUID(as_uuid=True),
        ForeignKey("packages.id", ondelete="CASCADE"),
        nullable=False,
    )
    project_url = Column(String(2048), nullable=False)
    last_access = Column(DateTime(timezone=True), default=datetime.utcnow)
    created_at = Column(DateTime(timezone=True), default=datetime.utcnow)

    package = relationship("Package", back_populates="consumers")

    __table_args__ = (
        Index("idx_consumers_package_id", "package_id"),
        Index("idx_consumers_last_access", "last_access"),
    )


class AccessPermission(Base):
    __tablename__ = "access_permissions"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    project_id = Column(
        UUID(as_uuid=True),
        ForeignKey("projects.id", ondelete="CASCADE"),
        nullable=False,
    )
    user_id = Column(String(255), nullable=False)
    level = Column(String(20), nullable=False)
    created_at = Column(DateTime(timezone=True), default=datetime.utcnow)
    expires_at = Column(DateTime(timezone=True))

    project = relationship("Project", back_populates="permissions")

    __table_args__ = (
        CheckConstraint("level IN ('read', 'write', 'admin')", name="check_level"),
        Index("idx_access_permissions_project_id", "project_id"),
        Index("idx_access_permissions_user_id", "user_id"),
    )


class User(Base):
    """User account for authentication."""

    __tablename__ = "users"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    username = Column(String(255), unique=True, nullable=False)
    password_hash = Column(String(255))  # NULL if OIDC-only user
    email = Column(String(255))
    is_admin = Column(Boolean, default=False)
    is_active = Column(Boolean, default=True)
    must_change_password = Column(Boolean, default=False)
    oidc_subject = Column(String(255))  # OIDC subject claim
    oidc_issuer = Column(String(512))  # OIDC issuer URL
    created_at = Column(DateTime(timezone=True), default=datetime.utcnow)
    updated_at = Column(
        DateTime(timezone=True), default=datetime.utcnow, onupdate=datetime.utcnow
    )
    last_login = Column(DateTime(timezone=True))

    # Relationships
    api_keys = relationship(
        "APIKey", back_populates="owner", cascade="all, delete-orphan"
    )
    sessions = relationship(
        "Session", back_populates="user", cascade="all, delete-orphan"
    )

    __table_args__ = (
        Index("idx_users_username", "username"),
        Index("idx_users_email", "email"),
        Index("idx_users_oidc_subject", "oidc_subject"),
    )


class Session(Base):
    """User session for web login."""

    __tablename__ = "sessions"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    user_id = Column(
        UUID(as_uuid=True),
        ForeignKey("users.id", ondelete="CASCADE"),
        nullable=False,
    )
    token_hash = Column(String(64), unique=True, nullable=False)
    created_at = Column(DateTime(timezone=True), default=datetime.utcnow)
    expires_at = Column(DateTime(timezone=True), nullable=False)
    last_accessed = Column(DateTime(timezone=True), default=datetime.utcnow)
    user_agent = Column(String(512))
    ip_address = Column(String(45))

    user = relationship("User", back_populates="sessions")

    __table_args__ = (
        Index("idx_sessions_user_id", "user_id"),
        Index("idx_sessions_token_hash", "token_hash"),
        Index("idx_sessions_expires_at", "expires_at"),
    )


class AuthSettings(Base):
    """Authentication settings for OIDC configuration."""

    __tablename__ = "auth_settings"

    key = Column(String(255), primary_key=True)
    value = Column(Text, nullable=False)
    updated_at = Column(DateTime(timezone=True), default=datetime.utcnow)


class APIKey(Base):
    __tablename__ = "api_keys"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    key_hash = Column(String(64), unique=True, nullable=False)
    name = Column(String(255), nullable=False)
    user_id = Column(
        String(255), nullable=False
    )  # Legacy field, kept for compatibility
    owner_id = Column(
        UUID(as_uuid=True),
        ForeignKey("users.id", ondelete="CASCADE"),
        nullable=True,  # Nullable for migration compatibility
    )
    description = Column(Text)
    scopes = Column(ARRAY(String), default=["read", "write"])
    created_at = Column(DateTime(timezone=True), default=datetime.utcnow)
    expires_at = Column(DateTime(timezone=True))
    last_used = Column(DateTime(timezone=True))

    owner = relationship("User", back_populates="api_keys")

    __table_args__ = (
        Index("idx_api_keys_user_id", "user_id"),
        Index("idx_api_keys_key_hash", "key_hash"),
        Index("idx_api_keys_owner_id", "owner_id"),
    )


class AuditLog(Base):
    __tablename__ = "audit_logs"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    action = Column(String(100), nullable=False)
    resource = Column(String(1024), nullable=False)
    user_id = Column(String(255), nullable=False)
    details = Column(JSON)
    timestamp = Column(DateTime(timezone=True), default=datetime.utcnow)
    source_ip = Column(String(45))

    __table_args__ = (
        Index("idx_audit_logs_action", "action"),
        Index("idx_audit_logs_resource", "resource"),
        Index("idx_audit_logs_user_id", "user_id"),
        Index("idx_audit_logs_timestamp", "timestamp"),
        Index("idx_audit_logs_resource_timestamp", "resource", "timestamp"),
        Index("idx_audit_logs_user_timestamp", "user_id", "timestamp"),
    )


class ProjectHistory(Base):
    """Track changes to project metadata over time."""

    __tablename__ = "project_history"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    project_id = Column(
        UUID(as_uuid=True),
        ForeignKey("projects.id", ondelete="CASCADE"),
        nullable=False,
    )
    field_name = Column(String(100), nullable=False)
    old_value = Column(Text)
    new_value = Column(Text)
    changed_at = Column(DateTime(timezone=True), default=datetime.utcnow)
    changed_by = Column(String(255), nullable=False)

    __table_args__ = (
        Index("idx_project_history_project_id", "project_id"),
        Index("idx_project_history_changed_at", "changed_at"),
        Index("idx_project_history_project_changed_at", "project_id", "changed_at"),
    )


class PackageHistory(Base):
    """Track changes to package metadata over time."""

    __tablename__ = "package_history"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    package_id = Column(
        UUID(as_uuid=True),
        ForeignKey("packages.id", ondelete="CASCADE"),
        nullable=False,
    )
    field_name = Column(String(100), nullable=False)
    old_value = Column(Text)
    new_value = Column(Text)
    changed_at = Column(DateTime(timezone=True), default=datetime.utcnow)
    changed_by = Column(String(255), nullable=False)

    __table_args__ = (
        Index("idx_package_history_package_id", "package_id"),
        Index("idx_package_history_changed_at", "changed_at"),
        Index("idx_package_history_package_changed_at", "package_id", "changed_at"),
    )


class ArtifactDependency(Base):
    """Dependency declared by an artifact on another package.

    Each artifact can declare dependencies on other packages, specifying either
    an exact version or a tag. This enables recursive dependency resolution.
    """

    __tablename__ = "artifact_dependencies"

    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
    artifact_id = Column(
        String(64),
        ForeignKey("artifacts.id", ondelete="CASCADE"),
        nullable=False,
    )
    dependency_project = Column(String(255), nullable=False)
    dependency_package = Column(String(255), nullable=False)
    version_constraint = Column(String(255), nullable=True)
    tag_constraint = Column(String(255), nullable=True)
    created_at = Column(DateTime(timezone=True), default=datetime.utcnow)

    # Relationship to the artifact that declares this dependency
    artifact = relationship("Artifact", back_populates="dependencies")

    __table_args__ = (
        # Exactly one of version_constraint or tag_constraint must be set
        CheckConstraint(
            "(version_constraint IS NOT NULL AND tag_constraint IS NULL) OR "
            "(version_constraint IS NULL AND tag_constraint IS NOT NULL)",
            name="check_constraint_type",
        ),
        # Each artifact can only depend on a specific project/package once
        Index(
            "idx_artifact_dependencies_artifact_id",
            "artifact_id",
        ),
        Index(
            "idx_artifact_dependencies_target",
            "dependency_project",
            "dependency_package",
        ),
        Index(
            "idx_artifact_dependencies_unique",
            "artifact_id",
            "dependency_project",
            "dependency_package",
            unique=True,
        ),
    )