"""The User aggregate — identity, credentials, roles, verification state."""

from __future__ import annotations

import uuid
from dataclasses import dataclass, field

from src.shared_kernel.entity import AggregateRoot


@dataclass(eq=False)
class User(AggregateRoot):
    """User aggregate root.

    Mutable entity (``eq=False`` so identity-based equality from ``AggregateRoot``
    is kept). Holds the persisted ``password_hash``; verifying a plaintext password
    is delegated to a ``PasswordHasher`` port in the application layer (the domain
    never imports argon2).
    """

    id: uuid.UUID
    email: str
    full_name: str
    password_hash: str
    email_verified: bool
    is_active: bool
    credential_version: int
    roles: tuple[str, ...] = ()
    phone: str | None = None
    unit_id: uuid.UUID | None = field(default=None)

    def can_authenticate(self) -> bool:
        """Account must be active to authenticate at all."""
        return self.is_active

    def requires_email_verification(self) -> bool:
        return not self.email_verified

    def bump_credential_version(self) -> None:
        """Invalidate all previously issued JWTs (password change/reset)."""
        self.credential_version = int(self.credential_version or 0) + 1
