/**
 * password_reset_tokens — PLANNING.md §6a, verbatim DDL.
 * Single-use, sha256-stored, 60-minute expiry. `purpose` covers both the
 * forgot-password flow and the admin-invite set-password flow (§8, §4b).
 */
import type { Knex } from 'knex';

export async function up(knex: Knex): Promise<void> {
  await knex.schema.raw(`
    CREATE TABLE password_reset_tokens (
      id            CHAR(26) NOT NULL PRIMARY KEY,
      admin_user_id CHAR(26) NOT NULL,
      token_hash    CHAR(64) NOT NULL,
      purpose       ENUM('reset','invite') NOT NULL DEFAULT 'reset',
      expires_at    DATETIME NOT NULL,
      used_at       DATETIME NULL,
      created_at    DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
      UNIQUE KEY uq_reset_token_hash (token_hash),
      KEY idx_reset_user (admin_user_id),
      CONSTRAINT fk_reset_user FOREIGN KEY (admin_user_id) REFERENCES admin_users(id) ON DELETE CASCADE
    ) ENGINE=InnoDB
  `);
}

export async function down(knex: Knex): Promise<void> {
  await knex.schema.raw('DROP TABLE IF EXISTS password_reset_tokens');
}