"""Session duration policy for accounts and organizations."""

from __future__ import annotations

from sqlalchemy.ext.asyncio import AsyncSession

from app.models import Account

DEFAULT_SESSION_TIMEOUT_MINUTES = 10_080  # 1 week

ALLOWED_SESSION_TIMEOUTS = (
    60,       # 1 hour
    120,      # 2 hours
    240,      # 4 hours
    480,      # 8 hours
    720,      # 12 hours
    1_440,    # 1 day
    2_880,    # 2 days
    4_320,    # 3 days
    7_200,    # 5 days
    10_080,   # 1 week
    20_160,   # 2 weeks
    43_200,   # 30 days
    64_800,   # 45 days
    86_400,   # 60 days
    129_600,  # 90 days
)

ALLOWED_SESSION_TIMEOUT_SET = set(ALLOWED_SESSION_TIMEOUTS)


def validate_session_timeout_minutes(minutes: int) -> None:
    if minutes not in ALLOWED_SESSION_TIMEOUT_SET:
        allowed = ", ".join(str(value) for value in ALLOWED_SESSION_TIMEOUTS)
        raise ValueError(f"Session timeout must be one of: {allowed}")


async def resolve_session_timeout_minutes(
    session: AsyncSession,
    account: Account,
) -> int:
    timeout = account.session_timeout_minutes or DEFAULT_SESSION_TIMEOUT_MINUTES
    if account.company_domain:
        from app.services.org_security import get_or_create_security_settings

        org = await get_or_create_security_settings(session, account.company_domain)
        timeout = min(timeout, org.session_timeout_minutes)
    return timeout