from django.db import models


class PendingEmailChange(models.Model):
    """A one-time link for an e-mail change. Owned by `profile` (AD-19).

    The token itself is never stored, only its SHA-256 hash (AD-9). A `confirm` row holds the
    address the user asked for (`new_address`) and the one they had then (`old_address`). An
    `undo` row holds the address to restore (`old_address`) and the one that was confirmed
    (`new_address`).
    """

    class Kind(models.TextChoices):
        CONFIRM = "confirm"
        UNDO = "undo"

    user_key = models.CharField(max_length=256, db_index=True)  # lower case
    sam = models.CharField(max_length=256)  # exact sAMAccountName, for directory calls
    kind = models.CharField(max_length=10, choices=Kind.choices)
    token_hash = models.CharField(max_length=64, unique=True)
    old_address = models.CharField(max_length=254, blank=True)
    new_address = models.CharField(max_length=254)
    created_at = models.DateTimeField()
    expires_at = models.DateTimeField()
    used_at = models.DateTimeField(null=True, blank=True)