/**
 * admin_users — PLANNING.md §6a, verbatim DDL.
 * Login identifier is the E.164 phone (§8); password_hash is NULL until an
 * invite is accepted. Self-FK records which admin created the row.
 */
import type { Knex } from 'knex';

export async function up(knex: Knex): Promise<void> {
  await knex.schema.raw(`
    CREATE TABLE admin_users (
      id              CHAR(26)     NOT NULL PRIMARY KEY,
      phone           VARCHAR(20)  NOT NULL,
      phone_display   VARCHAR(32)  NOT NULL,
      email           VARCHAR(254) NULL,
      name            VARCHAR(120) NOT NULL,
      password_hash   VARCHAR(255) NULL,
      role            ENUM('superadmin','admin') NOT NULL DEFAULT 'admin',
      status          ENUM('active','inactive')  NOT NULL DEFAULT 'active',
      failed_attempts SMALLINT UNSIGNED NOT NULL DEFAULT 0,
      locked_until    DATETIME NULL,
      last_login_at   DATETIME NULL,
      created_by      CHAR(26) NULL,
      created_at      DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
      updated_at      DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
      UNIQUE KEY uq_admin_users_phone (phone),
      UNIQUE KEY uq_admin_users_email (email),
      KEY idx_admin_users_status (status),
      CONSTRAINT fk_admin_users_creator FOREIGN KEY (created_by) REFERENCES admin_users(id)
    ) ENGINE=InnoDB
  `);
}

export async function down(knex: Knex): Promise<void> {
  await knex.schema.raw('DROP TABLE IF EXISTS admin_users');
}