from __future__ import annotations

from pydantic import BaseModel, Field, field_validator, model_validator


class IntegrationUpdate(BaseModel):
    use_default_aws_credentials: bool = False
    aws_access_key_id: str | None = Field(default=None, max_length=128)
    aws_secret_access_key: str | None = Field(default=None, max_length=256)
    aws_session_token: str | None = Field(default=None, max_length=4096)
    cloudflare_api_token: str | None = Field(default=None, max_length=2048)

    @field_validator(
        "aws_access_key_id",
        "aws_secret_access_key",
        "aws_session_token",
        "cloudflare_api_token",
        mode="before",
    )
    @classmethod
    def normalize_secret(cls, value: object) -> object:
        if value is None:
            return None
        normalized = str(value).strip()
        return normalized or None

    @model_validator(mode="after")
    def validate_aws_pair(self) -> IntegrationUpdate:
        if bool(self.aws_access_key_id) != bool(self.aws_secret_access_key):
            raise ValueError("AWS Access Key ID 和 Secret Access Key 需要同时填写")
        return self


class SecretFlags(BaseModel):
    aws_access_key_id: bool
    aws_secret_access_key: bool
    aws_session_token: bool
    cloudflare_api_token: bool


class IntegrationView(BaseModel):
    config_version: int
    use_default_aws_credentials: bool
    secrets_configured: SecretFlags