generator client {
  provider = "prisma-client-js"
  output   = "../generated/auth-client"
}

datasource db {
  provider = "postgresql"
  url      = env("AUTH_DATABASE_URL")
}

enum UserRole {
  PROGRAMMER
  MANAGER
  SUPERVISOR
  DATA_ENTRY
}

enum AccountStatus {
  ACTIVE
  EXPIRED
  DISABLED
}

model User {
  id             String        @id @default(cuid())
  employeeCode   String?       @unique
  username       String        @unique
  fullName       String
  email          String        @unique
  passwordHash   String
  role           UserRole
  status         AccountStatus @default(ACTIVE)
  supervisorId   String?
  branch         String?
  mustChangePass Boolean       @default(false)
  createdAt      DateTime      @default(now())
  updatedAt      DateTime      @updatedAt
  lastLoginAt    DateTime?
  failedLogins   Int           @default(0)
  lockedUntil    DateTime?
  resetCodes     PasswordResetCode[]
}

model PasswordResetCode {
  id          String   @id @default(cuid())
  userId      String
  codeHash    String
  expiresAt   DateTime
  attempts    Int      @default(0)
  consumedAt  DateTime?
  resetTicket String?  @unique
  ticketUntil DateTime?
  createdAt   DateTime @default(now())
  user        User     @relation(fields: [userId], references: [id], onDelete: Cascade)

  @@index([userId, createdAt])
}