Ekklesia/core/src/identity/schema.ts

import { relations } from "drizzle-orm";
import { boolean, index, pgTable, text, timestamp } from "drizzle-orm/pg-core";

/**
 * Core-owned Better Auth schema for the four required core models: user, session, account,
 * and verification. Table and index names are explicit and namespaced so ownership is
 * unambiguous inside the shared public PostgreSQL schema. Columns, types, defaults, uniqueness,
 * foreign keys, and delete behavior mirror the pinned [email protected] Drizzle/PostgreSQL
 * generator output exactly (see docs/development/identity.md for the regeneration workflow).
 */
export const ekklesiaCoreUser = pgTable("ekklesia_core_user", {
  id: text("id").primaryKey(),
  name: text("name").notNull(),
  email: text("email").notNull().unique(),
  emailVerified: boolean("email_verified").default(false).notNull(),
  image: text("image"),
  createdAt: timestamp("created_at").defaultNow().notNull(),
  updatedAt: timestamp("updated_at")
    .defaultNow()
    .$onUpdate(() => new Date())
    .notNull(),
});

export const ekklesiaCoreSession = pgTable(
  "ekklesia_core_session",
  {
    id: text("id").primaryKey(),
    expiresAt: timestamp("expires_at").notNull(),
    token: text("token").notNull().unique(),
    createdAt: timestamp("created_at").defaultNow().notNull(),
    updatedAt: timestamp("updated_at")
      .$onUpdate(() => new Date())
      .notNull(),
    ipAddress: text("ip_address"),
    userAgent: text("user_agent"),
    userId: text("user_id")
      .notNull()
      .references(() => ekklesiaCoreUser.id, { onDelete: "cascade" }),
  },
  (table) => [index("ekklesia_core_session_user_id_idx").on(table.userId)],
);

export const ekklesiaCoreAccount = pgTable(
  "ekklesia_core_account",
  {
    id: text("id").primaryKey(),
    accountId: text("account_id").notNull(),
    providerId: text("provider_id").notNull(),
    userId: text("user_id")
      .notNull()
      .references(() => ekklesiaCoreUser.id, { onDelete: "cascade" }),
    accessToken: text("access_token"),
    refreshToken: text("refresh_token"),
    idToken: text("id_token"),
    accessTokenExpiresAt: timestamp("access_token_expires_at"),
    refreshTokenExpiresAt: timestamp("refresh_token_expires_at"),
    scope: text("scope"),
    password: text("password"),
    createdAt: timestamp("created_at").defaultNow().notNull(),
    updatedAt: timestamp("updated_at")
      .$onUpdate(() => new Date())
      .notNull(),
  },
  (table) => [index("ekklesia_core_account_user_id_idx").on(table.userId)],
);

export const ekklesiaCoreVerification = pgTable(
  "ekklesia_core_verification",
  {
    id: text("id").primaryKey(),
    identifier: text("identifier").notNull(),
    value: text("value").notNull(),
    expiresAt: timestamp("expires_at").notNull(),
    createdAt: timestamp("created_at").defaultNow().notNull(),
    updatedAt: timestamp("updated_at")
      .defaultNow()
      .$onUpdate(() => new Date())
      .notNull(),
  },
  (table) => [index("ekklesia_core_verification_identifier_idx").on(table.identifier)],
);

export const ekklesiaCoreUserRelations = relations(ekklesiaCoreUser, ({ many }) => ({
  accounts: many(ekklesiaCoreAccount),
  sessions: many(ekklesiaCoreSession),
}));

export const ekklesiaCoreSessionRelations = relations(ekklesiaCoreSession, ({ one }) => ({
  user: one(ekklesiaCoreUser, {
    fields: [ekklesiaCoreSession.userId],
    references: [ekklesiaCoreUser.id],
  }),
}));

export const ekklesiaCoreAccountRelations = relations(ekklesiaCoreAccount, ({ one }) => ({
  user: one(ekklesiaCoreUser, {
    fields: [ekklesiaCoreAccount.userId],
    references: [ekklesiaCoreUser.id],
  }),
}));

/**
 * Explicit mapping from Better Auth's logical core model names to Ekklesia's physical schema
 * objects. Passed directly to the Drizzle adapter so table naming is never inferred by accident.
 */
export const identityAdapterSchema = {
  account: ekklesiaCoreAccount,
  session: ekklesiaCoreSession,
  user: ekklesiaCoreUser,
  verification: ekklesiaCoreVerification,
} as const;