# @File: models/oauth_identity.py
# @Desc: Persistent link between a verified OAuth provider identity and a
#        WHMCS client. One row per (provider, provider_sub) so the same Google
#        (or future Microsoft / LinkedIn) account always resolves back to the
#        same WHMCS client on repeat logins, even if the user later changes
#        their email address in WHMCS.
from models.base import BaseModel
from sqlalchemy import Column, Integer, String, UniqueConstraint


class OAuthIdentity(BaseModel):
    __tablename__ = "oauth_identities"
    __table_args__ = (
        UniqueConstraint("provider", "provider_sub", name="uq_oauth_identity_provider_sub"),
    )

    # Provider slug: "google" | "microsoft" | "linkedin".
    provider = Column(String(32), nullable=False, index=True)
    # The provider's stable subject identifier from the ID token (google "sub").
    provider_sub = Column(String(255), nullable=False, index=True)
    # Verified email at the time of link (lowercased). Informational only — the
    # authoritative link is (provider, provider_sub); emails can change.
    email = Column(String(320), nullable=False, index=True)
    # WHMCS client id this identity is linked to.
    whmcs_client_id = Column(Integer, nullable=False, index=True)