-- Create oauth_accounts table
CREATE TABLE IF NOT EXISTS `oauth_accounts` (
  `id` int NOT NULL AUTO_INCREMENT,
  `userId` int NOT NULL,
  `provider` enum('google','github','apple') NOT NULL,
  `providerAccountId` varchar(255) NOT NULL,
  `accessToken` text,
  `refreshToken` text,
  `expiresAt` timestamp,
  `scope` text,
  `tokenType` varchar(50),
  `idToken` text,
  `sessionState` varchar(255),
  `createdAt` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
  `updatedAt` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  PRIMARY KEY (`id`),
  KEY `idx_oauth_userId` (`userId`),
  KEY `idx_oauth_provider_account` (`provider`, `providerAccountId`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

-- Create two_factor_secrets table
CREATE TABLE IF NOT EXISTS `two_factor_secrets` (
  `id` int NOT NULL AUTO_INCREMENT,
  `userId` int NOT NULL,
  `secret` varchar(255) NOT NULL,
  `backupCodes` json,
  `isEnabled` tinyint NOT NULL DEFAULT 0,
  `enabledAt` timestamp,
  `lastVerifiedAt` timestamp,
  `createdAt` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
  `updatedAt` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  PRIMARY KEY (`id`),
  KEY `idx_2fa_userId` (`userId`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

-- Create magic_link_tokens table
CREATE TABLE IF NOT EXISTS `magic_link_tokens` (
  `id` int NOT NULL AUTO_INCREMENT,
  `token` varchar(255) NOT NULL UNIQUE,
  `email` varchar(255) NOT NULL,
  `userId` int,
  `expiresAt` timestamp NOT NULL,
  `usedAt` timestamp,
  `createdAt` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
  PRIMARY KEY (`id`),
  KEY `idx_magic_token` (`token`),
  KEY `idx_magic_email` (`email`),
  KEY `idx_magic_expiresAt` (`expiresAt`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

-- Create auth_audit_log table
CREATE TABLE IF NOT EXISTS `auth_audit_log` (
  `id` bigint NOT NULL AUTO_INCREMENT,
  `userId` int,
  `email` varchar(255),
  `action` enum('login','signup','logout','2fa_enable','2fa_disable','2fa_verify','magic_link_send','magic_link_verify','oauth_link','oauth_unlink') NOT NULL,
  `provider` varchar(50),
  `ipAddress` varchar(64),
  `userAgent` text,
  `success` tinyint NOT NULL DEFAULT 1,
  `errorMessage` text,
  `createdAt` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
  PRIMARY KEY (`id`),
  KEY `idx_auth_audit_userId` (`userId`),
  KEY `idx_auth_audit_action` (`action`),
  KEY `idx_auth_audit_createdAt` (`createdAt`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

-- Create rate_limit_log table
CREATE TABLE IF NOT EXISTS `rate_limit_log` (
  `id` bigint NOT NULL AUTO_INCREMENT,
  `ipAddress` varchar(64) NOT NULL,
  `endpoint` varchar(255) NOT NULL,
  `userId` int,
  `requestCount` int NOT NULL DEFAULT 1,
  `windowStart` timestamp NOT NULL,
  `windowEnd` timestamp NOT NULL,
  `isBlocked` tinyint NOT NULL DEFAULT 0,
  `createdAt` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
  PRIMARY KEY (`id`),
  KEY `idx_ratelimit_ip_endpoint` (`ipAddress`, `endpoint`),
  KEY `idx_ratelimit_isBlocked` (`isBlocked`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
