"""Request/response models for the auth endpoints.

These are the ONLY thing standing between the database and the HTTP response — FastAPI serialises
a SQLAlchemy/dataclass object through whichever `response_model` a route declares, so a field
simply not being listed here is what keeps password_hash/token_hash out of every response. When
adding a new field, ask whether it belongs in a response before adding it, not after.
"""

from uuid import UUID

from pydantic import BaseModel, EmailStr, Field


class RegisterRequest(BaseModel):
    email: EmailStr
    password: str = Field(min_length=8, max_length=200)
    display_name: str = Field(min_length=1, max_length=200)
    invite_code: str = Field(min_length=1, max_length=200)


class LoginRequest(BaseModel):
    email: EmailStr
    password: str = Field(min_length=1, max_length=200)


class UserOut(BaseModel):
    id: UUID
    email: str
    display_name: str