import { pgEnum, pgTable, text, timestamp } from "drizzle-orm/pg-core";
import { intId, intPk } from "./columns";
import { users } from "./identity";

export const authTokenPurposeEnum = pgEnum("auth_token_purpose", [
  "email_verify",
  "password_reset",
  "magic_link",
]);

// One table for every short-lived, single-use auth token (Features 1.1/1.2).
// Only the SHA-256 hash of the token is ever persisted — the raw value is
// mailed to the user and never touches the database.
export const authTokens = pgTable("auth_tokens", {
  id: intPk(),
  userId: intId("user_id")
    .notNull()
    .references(() => users.id),
  purpose: authTokenPurposeEnum("purpose").notNull(),
  tokenHash: text("token_hash").notNull(),
  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
  usedAt: timestamp("used_at", { withTimezone: true }),
  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
});