from users.models import Users
from users.plugins import ACCESS_TOKEN_EXPIRE_SECONDS


def serialize_user(
    user: Users,
    *,
    with_permissions: bool = False,
    permissions: tuple[str, ...] | list[str] | None = None,
) -> dict:
    """users row -> the shape the #rbac Users tab renders. Never includes password."""
    role = getattr(user, "role", None)
    role_name = None
    if role is not None:
        role_name = getattr(role.role_name, "value", role.role_name)

    data = {
        "id": str(user.id),
        "name": user.name,
        "email": user.email,
        "role_id": user.role_id,
        "role_name": role_name,
        "role_description": role.description if role is not None else None,
        "linkedin_url": user.linkedin_url or None,
        "is_active": user.is_active,
        "is_deleted": user.is_deleted,
        "created_at": user.created_at.isoformat() if user.created_at else None,
        "updated_at": user.updated_at.isoformat() if user.updated_at else None,
    }
    if with_permissions:
        data["permissions"] = list(permissions or ())
    return data


def serialize_token(access_token: str, refresh_token: str, user: Users) -> dict:
    """Login/refresh payload. OAuth2 fields live at the root so Swagger's Authorize can read them."""
    return {
        "access_token": access_token,
        "refresh_token": refresh_token,
        "token_type": "bearer",
        "expires_in": ACCESS_TOKEN_EXPIRE_SECONDS,
        "data": serialize_user(user),
    }