// Auth (Better Auth) - required tables

model User {
  id            String    @id @default(cuid())
  name          String
  email         String    @unique
  emailVerified Boolean   @default(false)
  image         String?
  onboardingCompleted Boolean @default(false)
  createdAt     DateTime  @default(now())
  updatedAt     DateTime  @updatedAt

  accounts        Account[]
  sessions        Session[]
  passkeys        Passkey[]
  groupsMember    GroupMember[]
  groupsOwner     Group[]        @relation("OwnerGroups")
  orgMemberships  Member[]
  orgInvitations  Invitation[]   @relation("InvitedBy")
  waitlist        WaitlistEntry[]
  merchantAccount MerchantAccount?

  @@map("users")
}

model Account {
  id                    String   @id @default(cuid())
  userId                String
  providerId            String
  accountId             String
  issuer                String
  accessToken           String?
  refreshToken          String?
  idToken               String?
  accessTokenExpiresAt  DateTime?
  refreshTokenExpiresAt DateTime?
  scope                 String?
  password              String?
  createdAt             DateTime @default(now())
  updatedAt             DateTime @updatedAt

  user User @relation(fields: [userId], references: [id], onDelete: Cascade)

  @@unique([issuer, accountId])
  @@index([userId])
  @@map("accounts")
}

model Session {
  id                   String   @id @default(cuid())
  userId               String
  token                String   @unique
  expiresAt            DateTime
  ipAddress            String?
  userAgent            String?
  activeOrganizationId String?
  createdAt            DateTime @default(now())
  updatedAt            DateTime @updatedAt

  user User @relation(fields: [userId], references: [id], onDelete: Cascade)

  @@map("sessions")
}

model Verification {
  id         String   @id @default(cuid())
  identifier String
  value      String
  expiresAt  DateTime
  createdAt  DateTime @default(now())
  updatedAt  DateTime @updatedAt

  @@unique([identifier, value])
  @@map("verifications")
}

// Better Auth - Organization plugin
model Organization {
  id        String   @id @default(cuid())
  name      String
  slug      String   @unique
  logo      String?
  metadata  Json?
  createdAt DateTime @default(now())
  updatedAt DateTime @updatedAt

  members     Member[]
  invitations Invitation[]

  @@map("organizations")
}

model Member {
  id             String   @id @default(cuid())
  organizationId String
  userId         String
  role           String   @default("member")
  createdAt      DateTime @default(now())

  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
  user         User         @relation(fields: [userId], references: [id], onDelete: Cascade)

  @@unique([organizationId, userId])
  @@map("members")
}

model Invitation {
  id             String   @id @default(cuid())
  organizationId String
  email          String
  role           String
  status         String   @default("pending")
  inviterId      String
  expiresAt      DateTime
  createdAt      DateTime @default(now())

  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
  inviter      User         @relation("InvitedBy", fields: [inviterId], references: [id], onDelete: Cascade)

  @@index([organizationId])
  @@map("invitations")
}

// Better Auth - Passkey plugin
model Passkey {
  id           String   @id @default(cuid())
  name         String?
  publicKey    String
  credentialID String   @unique
  userId       String
  counter      Int
  deviceType   String
  backedUp     Boolean
  transports   String?
  createdAt    DateTime @default(now())
  aaguid       String?

  user User @relation(fields: [userId], references: [id], onDelete: Cascade)

  @@index([userId])
  @@map("passkeys")
}