control

type APIKey struct {
	ID          uuid.UUID  `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id" format:"uuid"`
	OrgID       *uuid.UUID `json:"org_id,omitempty" format:"uuid"`
	Scope       string     `gorm:"not null;default:''" json:"scope"`
	Purpose     string     `json:"purpose"`
	IsEphemeral bool       `json:"is_ephemeral"`
	Name        string     `gorm:"not null;default:''" json:"name"`
	KeyHash     string     `gorm:"uniqueIndex;not null" json:"-"`
	SecretHash  *string    `json:"-"`
	UserID      *uuid.UUID `json:"user_id,omitempty" format:"uuid"`
	ExpiresAt   *time.Time `json:"expires_at,omitempty" format:"date-time"`
	Revoked     bool       `gorm:"not null;default:false" json:"revoked"`
	Prefix      *string    `json:"prefix,omitempty"`
	LastUsedAt  *time.Time `json:"last_used_at,omitempty" format:"date-time"`
	CreatedAt   time.Time  `json:"created_at" gorm:"type:timestamptz;column:created_at;not null;default:now()" format:"date-time"`
	UpdatedAt   time.Time  `json:"updated_at" gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()" format:"date-time"`
}

type Account struct {
	ID            uuid.UUID      `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id" format:"uuid"`
	UserID        uuid.UUID      `gorm:"index;not null" json:"user_id" format:"uuid"`
	User          User           `gorm:"foreignKey:UserID" json:"-"`
	Provider      string         `gorm:"not null" json:"provider"`
	Subject       string         `gorm:"not null" json:"subject"`
	Email         *string        `json:"email,omitempty"`
	EmailVerified bool           `gorm:"not null;default:false" json:"email_verified"`
	Profile       datatypes.JSON `gorm:"type:jsonb;not null;default:'{}'" json:"profile"`
	CreatedAt     time.Time      `gorm:"type:timestamptz;column:created_at;not null;default:now()" json:"created_at" format:"date-time"`
	UpdatedAt     time.Time      `gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()" json:"updated_at" format:"date-time"`
}

type AuthAccessRule struct {
	ID        uuid.UUID `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id"`
	Kind      string    `gorm:"not null;type:varchar(10);uniqueIndex:idx_auth_access_rules_kind_value_purpose,priority:1" json:"kind"`
	Value     string    `gorm:"not null;type:varchar(255);uniqueIndex:idx_auth_access_rules_kind_value_purpose,priority:2" json:"value"`
	Purpose   string    `` /* 222-byte string literal not displayed */
	Policy    string    `gorm:"not null;type:varchar(10);check:chk_auth_access_rules_policy,policy IN ('allow','deny')" json:"policy"`
	Reason    *string   `gorm:"type:text" json:"reason,omitempty"`
	CreatedAt time.Time `gorm:"type:timestamptz;column:created_at;not null;default:now()" json:"created_at"`
	UpdatedAt time.Time `gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()" json:"updated_at"`
}

type AuthAuditEvent struct {
	ID             uuid.UUID                          `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id"`
	SubjectID      uuid.UUID                          `gorm:"type:uuid;not null;index" json:"subject_id"`
	SubjectKind    string                             `gorm:"type:varchar(10);not null" json:"subject_kind"`
	OrganizationID uuid.UUID                          `gorm:"type:uuid;not null" json:"organization_id"`
	SessionID      *uuid.UUID                         `gorm:"type:uuid" json:"session_id,omitempty"`
	EventType      string                             `gorm:"type:varchar(30);not null;index" json:"event_type"`
	IPAddress      string                             `gorm:"type:varchar(45)" json:"ip_address,omitempty"`
	UserAgent      string                             `gorm:"type:text" json:"user_agent,omitempty"`
	Metadata       datatypes.JSONType[map[string]any] `gorm:"type:jsonb" json:"metadata,omitempty"`
	CreatedAt      time.Time                          `gorm:"type:timestamptz;not null;default:now()" json:"created_at"`
}

type AuthChallenge struct {
	ID uuid.UUID `gorm:"type:uuid;primaryKey;default:gen_random_uuid()"`

	JTI    uuid.UUID `gorm:"type:uuid;not null;uniqueIndex"`
	UserID uuid.UUID `gorm:"type:uuid;not null;index"`

	Kind string `gorm:"type:varchar(32);not null"`

	Attempts    int        `gorm:"not null;default:0"`
	MaxAttempts int        `gorm:"not null;default:5"`
	ConsumedAt  *time.Time `gorm:"type:timestamptz"`
	ExpiresAt   time.Time  `gorm:"type:timestamptz;not null;index"`
	CreatedAt   time.Time  `gorm:"type:timestamptz;not null;default:now()"`
}

type AuthFailure struct {
	ID uuid.UUID `gorm:"type:uuid;primaryKey;default:gen_random_uuid()"`

	Identifier string `gorm:"type:varchar(320);not null;uniqueIndex:idx_auth_failures_identifier_kind"`
	Kind       string `gorm:"type:varchar(32);not null;uniqueIndex:idx_auth_failures_identifier_kind"`
	Count      int    `gorm:"not null;default:0"`

	LockedUntil *time.Time `gorm:"type:timestamptz"`
	WindowStart time.Time  `gorm:"type:timestamptz;not null;default:now()"`

	LastFailedAt time.Time `gorm:"type:timestamptz;not null;default:now();index"`
}

type BeeEnrolmentToken struct {
	ID uuid.UUID `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id"`

	// The organization the host is admitted INTO, and the only thing this token
	// resolves. It carries no hive: a host enrols into an organization and joins
	// a fleet afterwards, as a task.
	//
	// That is not a simplification for its own sake — it is the same path a
	// MIGRATING host takes. Moving hv5 from fleet1 to fleet2 already means
	// leaving, existing in no fleet, then joining, so "join a fleet" has to work
	// from the fleetless state regardless. Enrolling straight into that state
	// means a new host and a migrating host follow identical code, instead of a
	// second path that is only exercised on day one.
	OrganizationID uuid.UUID    `gorm:"type:uuid;not null;index" json:"organization_id"`
	Organization   Organization `gorm:"foreignKey:OrganizationID;constraint:OnDelete:CASCADE" json:"-"`

	TokenHash string `gorm:"type:varchar(64);not null;uniqueIndex" json:"-"`

	// Uses is compared against MaxUses inside the enrolment transaction. Zero
	// MaxUses means unlimited within the expiry.
	Uses    int `gorm:"not null;default:0" json:"uses"`
	MaxUses int `gorm:"not null;default:0" json:"max_uses"`

	ExpiresAt time.Time  `gorm:"type:timestamptz;not null;index" json:"expires_at"`
	RevokedAt *time.Time `gorm:"type:timestamptz" json:"revoked_at,omitempty"`

	// NULL when this system minted the token rather than a person.
	//
	// Onboarding a host automatically means a worker needs a token to hand it,
	// and a worker has no user — there is no service principal in this model and
	// inventing one, or attributing the mint to whoever last logged in, would put
	// a name against an action they did not take. An audit column that is
	// sometimes a lie is worse than one that is sometimes empty.
	//
	// Not-null was what stopped this being wired at all: OnboardDeps.EnrolmentToken
	// was declared, nil-checked and never assigned, so every automated onboarding
	// failed at the enrol step with "no enrolment token source configured".
	CreatedByID *uuid.UUID `gorm:"type:uuid" json:"created_by_id,omitempty"`
	CreatedAt   time.Time  `gorm:"type:timestamptz;not null;default:now()" json:"created_at"`
}

type DomainCohortFinding struct {
	ID                  uuid.UUID `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id"`
	RegistrableDomain   string    `gorm:"type:varchar(253);not null;uniqueIndex:idx_domain_cohort_findings_registrable_domain" json:"registrable_domain"`
	OrganizationsTotal  int64     `gorm:"not null;default:0" json:"organizations_total"`
	OrganizationsProven int64     `gorm:"not null;default:0" json:"organizations_proven"`
	ProvenRatio         float64   `gorm:"type:double precision;not null;default:0" json:"proven_ratio"`
	Flagged             bool      `gorm:"not null;default:false;index" json:"flagged"`
	EvaluatedAt         time.Time `gorm:"type:timestamptz;not null;default:now()" json:"evaluated_at"`
}

type EffectiveFlag struct {
	Key     string     `json:"key"`
	Value   bool       `json:"value"`
	Source  FlagSource `json:"source"`
	Scope   FlagScope  `json:"scope"`
	Default bool       `json:"default"`
	Why     string     `json:"why,omitempty"`
}

type EmailChangeRequest struct {
	ID        uuid.UUID `gorm:"type:uuid;primaryKey;default:gen_random_uuid()"`
	UserID    uuid.UUID `gorm:"type:uuid;not null;index"`
	NewEmail  string    `gorm:"type:varchar(255);not null"`
	TokenHash string    `gorm:"type:varchar(64);not null;uniqueIndex"`
	ExpiresAt time.Time `gorm:"type:timestamptz;not null;index"`
	UsedAt    *time.Time
	CreatedAt time.Time `gorm:"type:timestamptz;not null;default:now()"`
}

type EmailVerificationToken struct {
	ID        uuid.UUID  `gorm:"type:uuid;primaryKey;default:gen_random_uuid()"`
	UserID    uuid.UUID  `gorm:"type:uuid;not null;index"`
	Email     string     `gorm:"type:varchar(255);not null"`
	TokenHash string     `gorm:"type:varchar(64);not null;uniqueIndex"`
	ExpiresAt time.Time  `gorm:"type:timestamptz;not null;index"`
	UsedAt    *time.Time `gorm:"type:timestamptz"`
	CreatedAt time.Time  `gorm:"type:timestamptz;not null;default:now()"`
}

type Flag struct {
	Key   string
	Scope FlagScope

	// Default is what applies when NEITHER level has a row.
	//
	// An absent row means "not set, fall through" and never "false". If absence
	// meant off, deleting a row would silently disable a feature, and the way to
	// restore a default would be to know what it used to be.
	Default bool

	// Why is shown beside the flag wherever it is listed. A flag nobody can
	// explain is a flag nobody dares delete.
	Why string

	// Public serves this flag to callers with NO CREDENTIAL AT ALL.
	//
	// It exists for one shape of problem: the sign-in page has to know whether
	// to render the password form, and it has to know that before anybody has
	// signed in. There is no authenticated read that can answer a question asked
	// by an anonymous browser.
	//
	// So this is an explicit, per-flag decision to publish a piece of platform
	// configuration to the internet, and it is opt-in for that reason — the zero
	// value keeps a flag private, so a new flag is never public by forgetting.
	//
	// ONLY MEANINGFUL ON A PLATFORM-SCOPED FLAG, and refused on any other by
	// TestOnlyPlatformScopedFlagsMayBePublic. A tenant-scoped flag resolves
	// differently per organization, and an anonymous caller has no organization
	// — so publishing one would either leak another tenant's configuration or
	// answer with a value that applies to nobody.
	//
	// What it publishes is worth being clear-eyed about: an anonymous caller
	// learns which sign-in methods this installation offers. That is already
	// visible to anyone who loads the page, which is why these two are safe and
	// why a flag whose name gives away something unreleased is not.
	Public bool

	// GuardsSignIn marks a flag that can take away a way of signing in.
	//
	// Turning one off is the only flag change that can lock every operator out
	// of the installation — including the ones who would turn it back on, since
	// turning it back on requires signing in. So a write that disables one is
	// checked against whether any other way in survives, and refused if none
	// does unless the caller says explicitly that they know.
	//
	// A property of the flag rather than a key compared in the service, so the
	// next flag that gates authentication is guarded by declaring it rather than
	// by somebody remembering to add it to a list.
	GuardsSignIn bool
}

type FlagScope string

type FlagSource string

type ImpersonationGrant struct {
	ID             uuid.UUID  `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id"`
	TargetUserID   uuid.UUID  `gorm:"type:uuid;not null;index" json:"target_user_id"`
	OrganizationID uuid.UUID  `gorm:"type:uuid;not null" json:"organization_id"`
	GrantedByID    uuid.UUID  `gorm:"type:uuid;not null" json:"granted_by_id"`
	Reason         string     `gorm:"type:text" json:"reason,omitempty"`
	ExpiresAt      time.Time  `gorm:"type:timestamptz;not null" json:"expires_at"`
	RevokedAt      *time.Time `gorm:"type:timestamptz" json:"revoked_at,omitempty"`
	CreatedAt      time.Time  `gorm:"type:timestamptz;not null;default:now()" json:"created_at"`
}

type Invitation struct {
	ID             uuid.UUID    `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id"`
	OrganizationID uuid.UUID    `gorm:"type:uuid;not null;index:idx_invitations_org_email,priority:1" json:"organization_id"`
	Organization   Organization `gorm:"foreignKey:OrganizationID;constraint:OnDelete:CASCADE" json:"-"`

	// InvitedByID is kept even after the inviter leaves the organization: the
	// question "who let this account in" has to remain answerable, and a
	// membership row that outlives its provenance cannot answer it.
	InvitedByID uuid.UUID `gorm:"type:uuid;not null;index" json:"invited_by_id"`

	// Email is lowercased on the way in. It is compared against the account that
	// redeems the token, so an invitation for one address can never be spent by
	// another even if the link is forwarded.
	Email string     `gorm:"type:varchar(255);not null;index:idx_invitations_org_email,priority:2" json:"email"`
	Role  MemberRole `gorm:"type:varchar(20);not null;default:'member'" json:"role"`

	TokenHash  string     `gorm:"type:varchar(64);not null;uniqueIndex" json:"-"`
	ExpiresAt  time.Time  `gorm:"type:timestamptz;not null;index" json:"expires_at"`
	AcceptedAt *time.Time `gorm:"type:timestamptz" json:"accepted_at,omitempty"`
	RevokedAt  *time.Time `gorm:"type:timestamptz" json:"revoked_at,omitempty"`
	CreatedAt  time.Time  `gorm:"type:timestamptz;not null;default:now()" json:"created_at"`
}

type MemberRole string

type Membership struct {
	ID             uuid.UUID    `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id"`
	UserID         uuid.UUID    `gorm:"index;not null" json:"user_id"`
	User           User         `gorm:"foreignKey:UserID" json:"-"`
	OrganizationID uuid.UUID    `gorm:"index;not null" json:"org_id"`
	Organization   Organization `gorm:"foreignKey:OrganizationID;constraint:OnDelete:CASCADE" json:"-"`
	Role           MemberRole   `gorm:"not null;default:'member'" json:"role"`
	SupportEnabled bool         `gorm:"default:false" json:"support_enabled"`
	CreatedAt      time.Time    `json:"created_at,omitempty" gorm:"type:timestamptz;column:created_at;not null;default:now()"`
	UpdatedAt      time.Time    `json:"updated_at,omitempty" gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()"`
}

type OAuthState struct {
	ID         uuid.UUID  `gorm:"type:uuid;primaryKey;default:gen_random_uuid()"`
	StateHash  string     `gorm:"type:varchar(64);not null;uniqueIndex"`
	Provider   string     `gorm:"type:varchar(32);not null"`
	Mode       string     `gorm:"type:varchar(32);not null;default:''"`
	Origin     string     `gorm:"type:text;not null;default:''"`
	CookieHash string     `gorm:"type:varchar(64);not null"`
	ExpiresAt  time.Time  `gorm:"type:timestamptz;not null;index"`
	ConsumedAt *time.Time `gorm:"type:timestamptz"`
	CreatedAt  time.Time  `gorm:"type:timestamptz;not null;default:now()"`
}

type OrgFeatureFlag struct {
	ID             uuid.UUID    `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id"`
	OrganizationID uuid.UUID    `gorm:"type:uuid;not null;uniqueIndex:idx_org_feature_flags_org_key" json:"organization_id"`
	Organization   Organization `gorm:"foreignKey:OrganizationID;constraint:OnDelete:CASCADE" json:"-"`
	Key            string       `gorm:"not null;type:varchar(120);uniqueIndex:idx_org_feature_flags_org_key" json:"key"`
	Value          bool         `gorm:"not null" json:"value"`
	UpdatedBy      uuid.UUID    `gorm:"type:uuid;not null" json:"updated_by"`
	CreatedAt      time.Time    `gorm:"type:timestamptz;not null;default:now()" json:"created_at"`
	UpdatedAt      time.Time    `gorm:"type:timestamptz;autoUpdateTime;not null;default:now()" json:"updated_at"`
}

type OrgPolicy struct {
	ID             uuid.UUID                        `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id"`
	OrganizationID uuid.UUID                        `gorm:"type:uuid;not null;uniqueIndex:idx_org_policies_org_kind" json:"organization_id"`
	Organization   Organization                     `gorm:"foreignKey:OrganizationID;constraint:OnDelete:CASCADE" json:"-"`
	Kind           PolicyKind                       `gorm:"not null;type:varchar(50);uniqueIndex:idx_org_policies_org_kind" json:"kind"`
	Enabled        bool                             `gorm:"not null;default:false" json:"enabled"`
	Config         datatypes.JSONType[PolicyConfig] `gorm:"type:jsonb;not null;default:'{}'" json:"config"`
	CreatedBy      uuid.UUID                        `gorm:"type:uuid;not null" json:"created_by"`
	CreatedAt      time.Time                        `gorm:"type:timestamptz;column:created_at;not null;default:now()" json:"created_at"`
	UpdatedAt      time.Time                        `gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()" json:"updated_at"`
}

type Organization struct {
	ID                  uuid.UUID  `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id"`
	Name                string     `gorm:"not null" json:"name"`
	Domain              *string    `gorm:"index" json:"domain"`
	DomainVerifiedAt    *time.Time `gorm:"column:domain_verified_at" json:"domain_verified_at,omitempty"`
	Status              string     `gorm:"not null;default:'pending'" json:"status"`
	ConnectionString    string     `gorm:"not null;default:''" json:"-"`
	EncryptedTenantKey  string     `gorm:"not null;default:''" json:"-"`
	TenantKeyIV         string     `gorm:"not null;default:''" json:"-"`
	TenantKeyTag        string     `gorm:"not null;default:''" json:"-"`
	ConnectionStringIV  string     `gorm:"not null;default:''" json:"-"`
	ConnectionStringTag string     `gorm:"not null;default:''" json:"-"`
	RegistrableDomain   *string    `gorm:"type:varchar(253);column:registrable_domain;index:idx_organizations_registrable_domain_proven,priority:1" json:"-"`
	ProvenAt            *time.Time `gorm:"type:timestamptz;column:proven_at;index:idx_organizations_registrable_domain_proven,priority:2" json:"-"`
	ProvingDaysSeen     int        `gorm:"column:proving_days_seen;not null;default:0" json:"-"`
	ProvingLastDay      *time.Time `gorm:"type:date;column:proving_last_day" json:"-"`

	// DeletedAt soft-deletes the organization, and soft is the only safe kind
	// here.
	//
	// This row holds EncryptedTenantKey and the sealed ConnectionString, which
	// are the ONLY things that can decrypt the tenant database. Deleting the row
	// destroys the customer's data whether or not the database is dropped: what
	// survives is ciphertext under a key that no longer exists anywhere. A hard
	// delete is therefore not "remove the record", it is "destroy everything,
	// irreversibly, from one API call".
	//
	// So deletion marks the row and stops it resolving. Purging the key material
	// and the database is a separate, deliberate operator step, which is what
	// gives a retention window and a way back from a mistaken deletion.
	DeletedAt *time.Time `gorm:"column:deleted_at;index" json:"deleted_at,omitempty"`

	CreatedAt time.Time `gorm:"column:created_at;not null;default:now()" json:"created_at"`
	UpdatedAt time.Time `gorm:"autoUpdateTime;column:updated_at;not null;default:now()" json:"updated_at"`
}

type PasswordResetToken struct {
	ID        uuid.UUID  `gorm:"type:uuid;primaryKey;default:gen_random_uuid()"`
	UserID    uuid.UUID  `gorm:"type:uuid;not null;index"`
	TokenHash string     `gorm:"type:varchar(64);not null;uniqueIndex"`
	ExpiresAt time.Time  `gorm:"type:timestamptz;not null"`
	UsedAt    *time.Time `gorm:"type:timestamptz"`
	CreatedAt time.Time  `gorm:"type:timestamptz;not null;default:now()"`
}

type PlatformFeatureFlag struct {
	ID        uuid.UUID `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id"`
	Key       string    `gorm:"not null;type:varchar(120);uniqueIndex" json:"key"`
	Value     bool      `gorm:"not null" json:"value"`
	UpdatedBy uuid.UUID `gorm:"type:uuid;not null" json:"updated_by"`
	CreatedAt time.Time `gorm:"type:timestamptz;not null;default:now()" json:"created_at"`
	UpdatedAt time.Time `gorm:"type:timestamptz;autoUpdateTime;not null;default:now()" json:"updated_at"`
}

type PlatformPolicy struct {
	ID        uuid.UUID                        `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id"`
	Kind      PolicyKind                       `gorm:"not null;type:varchar(50);uniqueIndex" json:"kind"`
	Enabled   bool                             `gorm:"not null;default:false" json:"enabled"`
	Config    datatypes.JSONType[PolicyConfig] `gorm:"type:jsonb;not null;default:'{}'" json:"config"`
	CreatedBy uuid.UUID                        `gorm:"type:uuid;not null" json:"created_by"`
	CreatedAt time.Time                        `gorm:"type:timestamptz;column:created_at;not null;default:now()" json:"created_at"`
	UpdatedAt time.Time                        `gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()" json:"updated_at"`
}

type PolicyConfig struct {
	MinLength          int  `json:"min_length,omitempty"`
	RequireUppercase   bool `json:"require_uppercase,omitempty"`
	RequireLowercase   bool `json:"require_lowercase,omitempty"`
	RequireDigit       bool `json:"require_digit,omitempty"`
	RequireSpecial     bool `json:"require_special,omitempty"`
	MaxLifetimeMinutes int  `json:"max_lifetime_minutes,omitempty"`
}

type PolicyKind string

type TokenSession struct {
	ID               uuid.UUID  `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id"`
	SubjectID        uuid.UUID  `gorm:"type:uuid;not null;index:idx_token_sessions_subject,composite:subject" json:"subject_id"`
	SubjectKind      string     `gorm:"type:varchar(10);not null;index:idx_token_sessions_subject,composite:subject" json:"subject_kind"`
	OrganizationID   uuid.UUID  `gorm:"type:uuid;not null;index" json:"organization_id"`
	FamilyID         uuid.UUID  `gorm:"type:uuid;not null;index" json:"family_id"`
	AccessTokenJTI   string     `gorm:"type:varchar(36);uniqueIndex;not null" json:"-"`
	RefreshTokenJTI  string     `gorm:"type:varchar(36);uniqueIndex;not null" json:"-"`
	AccessTokenHash  string     `gorm:"type:varchar(64);not null" json:"-"`
	RefreshTokenHash string     `gorm:"type:varchar(64);not null" json:"-"`
	ActorID          *uuid.UUID `gorm:"type:uuid" json:"actor_id,omitempty"`
	AMR              string     `gorm:"type:varchar(100)" json:"amr,omitempty"`
	IPAddress        string     `gorm:"type:varchar(45)" json:"ip_address,omitempty"`
	UserAgent        string     `gorm:"type:text" json:"user_agent,omitempty"`
	AccessExpiresAt  time.Time  `gorm:"type:timestamptz;not null" json:"access_expires_at"`
	RefreshExpiresAt time.Time  `gorm:"type:timestamptz;not null" json:"refresh_expires_at"`
	RevokedAt        *time.Time `gorm:"type:timestamptz" json:"revoked_at,omitempty"`
	CreatedAt        time.Time  `gorm:"type:timestamptz;not null;default:now()" json:"created_at"`
}

type User struct {
	ID         uuid.UUID `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id"`
	Email      string    `gorm:"uniqueIndex;not null;type:varchar(255)" json:"email"`
	Password   string    `gorm:"not null;type:varchar(255)" json:"-"`
	FirstName  string    `gorm:"not null;type:varchar(100)" json:"first_name"`
	LastName   string    `gorm:"not null;type:varchar(100)" json:"last_name"`
	Role       UserRole  `gorm:"not null;default:'platform_customer';type:varchar(20)" json:"role"`
	MFAEnabled bool      `gorm:"default:false" json:"mfa_enabled"`
	// EmailVerifiedAt records when this user proved control of Email. It is a
	// timestamp rather than a bool to match ProvenAt and DomainVerifiedAt, and
	// because "when" is what an audit of a disputed registration needs.
	//
	// It lives on User, not on Account: Account is the social-identity table and
	// a password registration has no row there at all, so Account.EmailVerified
	// can only ever speak for an address an IdP asserted.
	EmailVerifiedAt *time.Time `gorm:"type:timestamptz;column:email_verified_at" json:"email_verified_at,omitempty"`
	IsActive        bool       `gorm:"default:true" json:"is_active"`

	// DeletedAt soft-deletes the account.
	//
	// The row is kept because other records point at it and must stay readable:
	// audit events name the actor, fleet tasks name who created them, and
	// memberships record who invited whom. Removing the row would either break
	// those references or cascade them away — and an audit trail that disappears
	// when the account does is an audit trail that can be erased by the person
	// being audited.
	//
	// Distinct from IsActive, which is a suspension: reversible, and the account
	// still exists. This is the account being gone.
	DeletedAt       *time.Time `gorm:"column:deleted_at;index" json:"deleted_at,omitempty"`
	TokensRevokedAt *time.Time `gorm:"type:timestamptz" json:"-"`
	LastLoginAt     *time.Time `gorm:"autoUpdateTime;column:last_login_at;not null;default:now()" json:"last_login_at,omitempty"`
	CreatedAt       time.Time  `json:"created_at,omitempty" gorm:"type:timestamptz;column:created_at;not null;default:now()"`
	UpdatedAt       time.Time  `json:"updated_at,omitempty" gorm:"type:timestamptz;autoUpdateTime;column:updated_at;not null;default:now()"`
}

type UserPasskey struct {
	ID              uuid.UUID                    `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id"`
	UserID          uuid.UUID                    `gorm:"type:uuid;index;not null" json:"user_id"`
	CredentialID    string                       `gorm:"uniqueIndex;not null;type:text" json:"credential_id"`
	PublicKey       []byte                       `gorm:"not null;type:bytea" json:"-"`
	AttestationType string                       `gorm:"not null;type:varchar(64)" json:"attestation_type"`
	AAGUID          string                       `gorm:"type:varchar(36)" json:"aaguid"`
	SignCount       uint32                       `gorm:"not null;default:0" json:"sign_count"`
	BackupEligible  bool                         `gorm:"not null;default:false" json:"backup_eligible"`
	BackupState     bool                         `gorm:"not null;default:false" json:"backup_state"`
	Name            string                       `gorm:"not null;type:varchar(255)" json:"name"`
	Transports      datatypes.JSONType[[]string] `gorm:"type:jsonb" json:"transports"`
	LastUsedAt      *time.Time                   `json:"last_used_at,omitempty"`
	CreatedAt       time.Time                    `json:"created_at" gorm:"type:timestamptz;not null;default:now()"`
}

type UserRole string

type UserTOTP struct {
	ID           uuid.UUID `gorm:"type:uuid;primaryKey;default:gen_random_uuid()" json:"id"`
	UserID       uuid.UUID `gorm:"type:uuid;uniqueIndex;not null" json:"user_id"`
	Secret       string    `gorm:"not null;type:text" json:"-"`
	Verified     bool      `gorm:"default:false" json:"verified"`
	LastUsedStep int64     `gorm:"not null;default:0" json:"-"`
	CreatedAt    time.Time `json:"created_at" gorm:"type:timestamptz;not null;default:now()"`
	UpdatedAt    time.Time `json:"updated_at" gorm:"type:timestamptz;autoUpdateTime;not null;default:now()"`
}