/**
 * Customer Portal schema — tenant-portals (wave 9).
 *
 * Tables:
 *   portal_sessions — SHA-256 hashes of portal JWTs with expiry/revocation
 */
import { isNull } from 'drizzle-orm'
import { pgTable, uuid, text, timestamp, index, uniqueIndex } from 'drizzle-orm/pg-core'
import { tenants } from './tenants'
import { customers } from './customers'
import { users } from './users'

export const portalSessions = pgTable(
  'portal_sessions',
  {
    id: uuid('id').primaryKey().defaultRandom(),
    tenantId: uuid('tenant_id')
      .notNull()
      .references(() => tenants.id, { onDelete: 'cascade' }),
    customerId: uuid('customer_id')
      .notNull()
      .references(() => customers.id, { onDelete: 'cascade' }),
    userId: uuid('user_id')
      .notNull()
      .references(() => users.id, { onDelete: 'cascade' }),
    tokenHash: text('token_hash').notNull(),
    expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
    revokedAt: timestamp('revoked_at', { withTimezone: true }),
    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
  },
  (t) => ({
    tokenIdx: uniqueIndex('idx_portal_sessions_token').on(t.tokenHash),
    customerIdx: index('idx_portal_sessions_customer')
      .on(t.tenantId, t.customerId)
      .where(isNull(t.revokedAt)),
  }),
)

export type PortalSession = typeof portalSessions.$inferSelect