Source code for cadrumo.application.user_profile.aggregate

"""Non-authoritative projection of one committed profile capsule.

Custody material is deliberately absent.  A profile view is visible only after
the storage owner has validated its immutable commit marker; the label is the
repository's presentation mapping, never a manifest or a key-selection hint.
"""

from __future__ import annotations

from datetime import datetime
from typing import Annotated, Literal

from pydantic import BaseModel, ConfigDict, Field, NonNegativeInt, field_validator

from ...core.errors.hierarchy import pydantic_validation_boundary
from ...core.identity.digest import ContentDigest, PrefixedContentDigest
from ...core.identity.profile import ProfileId
from ...core.identity.profile_label import ProfileLabel
from ...core.profile_publication import ProfilePublicationKindValue
from ...core.time.utc import validate_utc_aware
from ...domain.user_profile.values import ProfileSetupState




class LockedProfileFactSummary(BaseModel):
    """The only fact/status projection available without an unlocked session."""

    model_config = ConfigDict(strict=True, frozen=True, extra="forbid", hide_input_in_errors=True)

    availability: Literal["UNAVAILABLE_LOCKED"] = "UNAVAILABLE_LOCKED"
    setup_state: Literal["UNAVAILABLE_LOCKED"] = "UNAVAILABLE_LOCKED"
    fact_count: Literal[0] = 0





class UnlockedProfileFactSummary(BaseModel):
    """Session-authenticated current-record summary and provenance."""

    model_config = ConfigDict(strict=True, frozen=True, extra="forbid", hide_input_in_errors=True)

    availability: Literal["AVAILABLE_UNLOCKED"] = "AVAILABLE_UNLOCKED"
    setup_state: ProfileSetupState
    fact_count: NonNegativeInt
    record_revision: int = Field(ge=1)
    content_digest: ContentDigest



type ProfileFactSummary = Annotated[
    LockedProfileFactSummary | UnlockedProfileFactSummary,
    Field(discriminator="availability"),
]


type ProfileRestoreAuthority = Literal["password"]
"""Which door proved the key a restore republishes a capsule under.

Declared beside ``publication_kind`` because it is the same class of axis and
answers the question that one leaves open: a view already says a capsule was
published by a restore, but not what authorised it. ``password`` means the
profile's own credential unwrapped its own envelope. A recovery code never
restores a capsule: it proves the enrolled wrapper of a COMMITTED capsule so a
lost passphrase can be replaced in place, which is a different door.
"""




class CommittedProfileView(BaseModel):
    """A safe read model, assembled from a committed capsule and label owner."""

    model_config = ConfigDict(strict=True, frozen=True, extra="forbid", hide_input_in_errors=True)

    profile_id: ProfileId
    label: ProfileLabel
    committed_at: datetime
    publication_kind: ProfilePublicationKindValue
    password_generation: int = Field(ge=1)
    custody_present: Literal[True] = True
    label_revision: int = Field(ge=1)
    label_content_digest: PrefixedContentDigest
    label_self_digest: PrefixedContentDigest
    label_source_witness: PrefixedContentDigest
    fact_summary: ProfileFactSummary = Field(default_factory=LockedProfileFactSummary)

    @field_validator("committed_at")
    @classmethod
    @pydantic_validation_boundary
    def _validate_committed_at(cls, value: datetime) -> datetime:
        return validate_utc_aware(value)



__all__ = [
    "CommittedProfileView",
    "LockedProfileFactSummary",
    "ProfileFactSummary",
    "ProfileRestoreAuthority",
    "UnlockedProfileFactSummary",
]