/**
 * admin_users — foundation-auth-rbac.
 * Zync staff accounts for the cross-tenant admin control plane.
 * totp_secret is AES-256-GCM encrypted (ADMIN_ENCRYPTION_KEY); NULL = not enrolled.
 */
import { pgTable, uuid, text, timestamp, check } from 'drizzle-orm/pg-core'
import { sql } from 'drizzle-orm'

export const adminUsers = pgTable(
  'admin_users',
  {
    id: uuid('id').primaryKey().defaultRandom(),
    email: text('email').notNull().unique(),
    passwordHash: text('password_hash').notNull(),
    totpSecret: text('totp_secret'), // AES-256-GCM encrypted; NULL = not yet enrolled
    // status: 'active' | 'suspended'
    status: text('status').notNull().default('active'),
    // role_id FK to admin_roles (nullable; NULL = no explicit role, inherits no permissions)
    roleId: uuid('role_id'),
    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
  },
  (t) => ({
    statusCheck: check('admin_users_status_check', sql`${t.status} IN ('active', 'suspended')`),
  }),
)

export type AdminUserRow = typeof adminUsers.$inferSelect
export type NewAdminUser = typeof adminUsers.$inferInsert