schema.prisma

generator client {
  provider = "prisma-client-js"
}

datasource db {
  provider = "sqlite"
  url      = env("DATABASE_URL")
}

model AdapterConfig {
  id               String   @id @default(uuid())
  name             String
  type             String
  adapterId        String
  config           String
  metadata         String? // Stores non-sensitive runtime data (e.g., version, connection status)
  createdAt        DateTime @default(now())
  updatedAt        DateTime @updatedAt
  jobsSource       Job[]    @relation("Source")
  jobsNotification Job[]    @relation("Notifications")
  jobDestinations  JobDestination[]
  jobSources       JobSource[]                   @relation("JobSourceConfig")
  notificationTemplateChannels NotificationTemplateChannel[]

  // Storage adapters only (app enforces this): a config is either a backup destination or
  // a directory backup source, never both. A destination owns its configured root - backups
  // and their chain folders are written into it - while a source only reads the folders
  // picked for it. Sharing one config would let a job back up its own archives.
  // DESTINATION | SOURCE, see STORAGE_ROLES in src/lib/core/storage-roles.ts.
  storageRole String @default("DESTINATION")

  // Credential profile references (Phase 1: nullable; app enforces required-ness based on adapter type)
  primaryCredentialId String?
  primaryCredential   CredentialProfile? @relation("PrimaryCredential", fields: [primaryCredentialId], references: [id], onDelete: Restrict)
  sshCredentialId     String?
  sshCredential       CredentialProfile? @relation("SshCredential", fields: [sshCredentialId], references: [id], onDelete: Restrict)

  // Default retention policy for storage destinations (pre-fills job form when destination is added)
  defaultRetentionPolicyId String?
  defaultRetentionPolicy   RetentionPolicy? @relation(fields: [defaultRetentionPolicyId], references: [id], onDelete: SetNull)

  // Caching-Felder für schnelle UI-Anzeige ohne Joins
  lastHealthCheck      DateTime?
  lastStatus           String        @default("ONLINE") // ONLINE, DEGRADED, OFFLINE
  lastError            String?       // Human-readable reason when lastStatus != ONLINE (e.g. "No credential profile assigned")
  consecutiveFailures  Int           @default(0) // Zähler für Logik (Grün -> Orange -> Rot)

  healthLogs           HealthCheckLog[]
  versionHistory       DbVersionHistory[]
  storageListCache     StorageListCache?
}

model CredentialProfile {
  id          String   @id @default(cuid())
  name        String   @unique
  description String?
  type        String   // USERNAME_PASSWORD | SSH_KEY | ACCESS_KEY | TOKEN | SMTP
  data        String   // Encrypted JSON payload (encrypt(JSON.stringify(payload)))
  createdAt   DateTime @default(now())
  updatedAt   DateTime @updatedAt

  primaryAdapters AdapterConfig[] @relation("PrimaryCredential")
  sshAdapters     AdapterConfig[] @relation("SshCredential")
}

model EncryptionProfile {
  id          String   @id @default(cuid())
  name        String
  description String?
  secretKey   String
  jobs        Job[]
  createdAt   DateTime @default(now())
  updatedAt   DateTime @updatedAt
}

model RetentionPolicy {
  id          String           @id @default(cuid())
  name        String           @unique
  description String?
  config      String           // JSON RetentionConfiguration (same format as legacy JobDestination.retention)
  isDefault   Boolean          @default(false)
  isSystem    Boolean          @default(false)
  createdAt   DateTime         @default(now())
  updatedAt   DateTime         @updatedAt
  jobDestinations JobDestination[]
  adapterConfigs  AdapterConfig[]
}

model NamingTemplate {
  id          String   @id @default(cuid())
  name        String   @unique
  description String?
  pattern     String   // e.g. "{name}_yyyy-MM-dd_HH-mm-ss"
  isDefault   Boolean  @default(false) // Only one can be true at a time
  isSystem    Boolean  @default(false) // System templates are read-only in the UI
  createdAt   DateTime @default(now())
  updatedAt   DateTime @updatedAt
  jobs        Job[]
}

model SchedulePreset {
  id          String   @id @default(cuid())
  name        String   @unique
  description String?
  schedule    String   // Cron expression (5-part format)
  createdAt   DateTime @default(now())
  updatedAt   DateTime @updatedAt
  jobs        Job[]
}

model ExcludePatternPreset {
  id          String      @id @default(cuid())
  name        String      @unique
  description String?
  patterns    String      // JSON array of the preset's OWN glob patterns, on top of any groups below
  groups      String      @default("[]") // JSON array of curated group ids from src/lib/exclude-groups.ts - referenced, not copied, so releases can extend them
  excludedGroupPatterns String @default("[]") // JSON array of individual group patterns this preset opts out of
  isDefault   Boolean     @default(false) // Pre-selected on newly added directory sources; several may be default
  isSystem    Boolean     @default(false)
  createdAt   DateTime    @default(now())
  updatedAt   DateTime    @updatedAt
  jobSources  JobSource[]
}

model Job {
  id                  String             @id @default(uuid())
  name                String
  schedule            String
  enabled             Boolean            @default(true)
  sourceId            String?
  databases           String             @default("[]") // JSON array of database names to back up (e.g. ["db1","db2"])
  encryptionProfileId String?
  encryptionProfile   EncryptionProfile? @relation(fields: [encryptionProfileId], references: [id])
  compression         String             @default("NONE")
  pgCompression       String             @default("") // PostgreSQL native dump compression: "" (legacy gzip-6), "NONE", "GZIP:6", "LZ4:1", "ZSTD:3"
  namingTemplateId    String?            // References NamingTemplate; null = use system default at runtime
  namingTemplate      NamingTemplate?    @relation(fields: [namingTemplateId], references: [id], onDelete: SetNull)
  schedulePresetId    String?            // Live-link to a SchedulePreset; scheduler uses preset.schedule when set
  schedulePreset      SchedulePreset?    @relation(fields: [schedulePresetId], references: [id], onDelete: SetNull)
  createdAt           DateTime           @default(now())
  updatedAt           DateTime           @updatedAt
  executions          Execution[]
  destinations        JobDestination[]
  source              AdapterConfig?     @relation("Source", fields: [sourceId], references: [id], onDelete: Restrict)
  sources             JobSource[]
  notifications       AdapterConfig[]    @relation("Notifications")
  notificationEvents  String             @default("ALWAYS") // Legacy: "ALWAYS", "FAILURE_ONLY", "SUCCESS_ONLY" - kept for backward compat
  notificationTemplates JobNotificationTemplate[]
  skipVerification    Boolean            @default(false)
  // Incremental backups (directory sources only - database dumps are always full).
  backupMode          String             @default("FULL")  // "FULL" | "INCREMENTAL"
  fullEveryDays       Int                @default(7)       // Forces a fresh chain this often
  verifyByHash        Boolean            @default(false)   // Hash every file instead of trusting size+mtime
}

model NotificationTemplate {
  id          String   @id @default(cuid())
  name        String   @unique
  description String?
  isDefault   Boolean  @default(false)
  isSystem    Boolean  @default(false)
  channels    NotificationTemplateChannel[]
  jobs        JobNotificationTemplate[]
  createdAt   DateTime @default(now())
  updatedAt   DateTime @updatedAt
}

model NotificationTemplateChannel {
  id         String               @id @default(cuid())
  templateId String
  configId   String
  events     String               @default("SUCCESS|PARTIAL|FAILED") // Pipe-separated: SUCCESS, PARTIAL, FAILED
  template   NotificationTemplate @relation(fields: [templateId], references: [id], onDelete: Cascade)
  config     AdapterConfig        @relation(fields: [configId], references: [id])

  @@unique([templateId, configId])
}

model JobNotificationTemplate {
  id         String               @id @default(cuid())
  jobId      String
  templateId String
  priority   Int                  @default(0)
  job        Job                  @relation(fields: [jobId], references: [id], onDelete: Cascade)
  template   NotificationTemplate @relation(fields: [templateId], references: [id])

  @@unique([jobId, templateId])
}

model JobDestination {
  id                   String           @id @default(uuid())
  jobId                String
  configId             String
  priority             Int              @default(0) // Upload order (ascending)
  retention            String           @default("{}") // Legacy: RetentionConfiguration JSON (kept for backward compat)
  retentionPolicyId    String?          // References RetentionPolicy template; takes precedence over retention JSON
  retentionPolicy      RetentionPolicy? @relation(fields: [retentionPolicyId], references: [id], onDelete: SetNull)
  createdAt            DateTime         @default(now())
  updatedAt            DateTime         @updatedAt

  job        Job           @relation(fields: [jobId], references: [id], onDelete: Cascade)
  config     AdapterConfig @relation(fields: [configId], references: [id])

  @@unique([jobId, configId])
}

model JobSource {
  id                     String                @id @default(uuid())
  jobId                  String
  configId               String
  priority               Int                   @default(0) // Collection/manifest ordering
  path                   String                // Remote path on the storage adapter to pull from
  excludePatterns        String                @default("[]") // JSON array of job-specific extra glob patterns (in addition to any linked presets' patterns)
  excludePatternPresets  ExcludePatternPreset[] // Live-linked templates - re-read fresh at execution time (see 01-initialize.ts); patterns from every linked preset are unioned
  useStagingCache        Boolean               @default(false) // Reserved for a later phase (persistent rsync mirror); unused for now
  createdAt              DateTime              @default(now())
  updatedAt              DateTime              @updatedAt

  job    Job           @relation(fields: [jobId], references: [id], onDelete: Cascade)
  config AdapterConfig @relation("JobSourceConfig", fields: [configId], references: [id], onDelete: Restrict)

  @@unique([jobId, configId, path])
}

model Execution {
  id           String    @id @default(uuid())
  jobId        String?
  type         String    @default("Backup")
  status       String
  logs         String
  startedAt    DateTime  @default(now())
  endedAt      DateTime?
  size         BigInt?
  path         String?
  metadata     String?
  triggerType  String?   // "Manual" | "Scheduler" | "Api"
  triggerLabel String?   // e.g. user name, API key name, "Scheduler"
  // Incremental chain bookkeeping. All null for a standalone full backup.
  backupType   String?   // "Full" | "Incremental"
  chainId      String?   // Shared by the full and every incremental built on it
  baseArchive  String?   // Filename of the predecessor, not an Execution id
  chainIndex   Int?      // Position in the chain, full = 0
  logicalSize  BigInt?   // Full snapshot size, as opposed to `size` which is what was stored
  job          Job?      @relation(fields: [jobId], references: [id])
}

model User {
  id               String     @id
  name             String
  email            String     @unique
  emailVerified    Boolean
  image            String?
  timezone         String     @default("")
  dateFormat       String     @default("P")
  timeFormat       String     @default("p")
  autoRedirectOnJobStart Boolean @default(true)
  createdAt        DateTime
  updatedAt        DateTime
  twoFactorEnabled Boolean?
  passkeyTwoFactor Boolean?   @default(false)
  twoFactor        TwoFactor?
  accounts         Account[]
  passkeys         Passkey[]
  sessions         Session[]
  auditLogs        AuditLog[]
  apiKeys          ApiKey[]

  groupId String?
  group   Group?  @relation(fields: [groupId], references: [id])
}

model SystemSetting {
  key         String   @id
  value       String
  description String?
  updatedAt   DateTime @updatedAt
}

model Group {
  id          String   @id @default(uuid())
  name        String   @unique
  permissions String // Stored as JSON
  createdAt   DateTime @default(now())
  updatedAt   DateTime @updatedAt
  users       User[]
}

model TwoFactor {
  id                      String    @id
  secret                  String
  backupCodes             String
  userId                  String    @unique
  verified                Boolean   @default(false)
  // Rate limiting fields required by better-auth >= 1.6 two-factor plugin.
  failedVerificationCount Int       @default(0)
  lockedUntil             DateTime?
  user                    User      @relation(fields: [userId], references: [id], onDelete: Cascade)
}

model Passkey {
  id           String    @id
  name         String?
  publicKey    String
  userId       String
  credentialID String    @unique
  counter      Int
  deviceType   String
  backedUp     Boolean
  transports   String?
  createdAt    DateTime?
  aaguid       String?
  user         User      @relation(fields: [userId], references: [id], onDelete: Cascade)
}

model Session {
  id        String   @id
  expiresAt DateTime
  token     String   @unique
  createdAt DateTime
  updatedAt DateTime
  ipAddress String?
  userAgent String?
  userId    String
  user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
}

model Account {
  id                    String    @id
  accountId             String
  providerId            String
  userId                String
  accessToken           String?
  refreshToken          String?
  idToken               String?
  accessTokenExpiresAt  DateTime?
  refreshTokenExpiresAt DateTime?
  scope                 String?
  password              String?
  createdAt             DateTime
  updatedAt             DateTime
  user                  User      @relation(fields: [userId], references: [id], onDelete: Cascade)
}

model Verification {
  id         String    @id
  identifier String
  value      String
  expiresAt  DateTime
  createdAt  DateTime?
  updatedAt  DateTime?
}

model SsoProvider {
  id             String   @id @default(cuid())
  providerId     String   @unique // e.g. "authentik-main"
  type           String   @default("oidc") // "oidc" or "saml"
  domain         String?  // Required by better-auth SSO plugin for email domain matching
  domainVerified Boolean  @default(false) // Required by better-auth for trusted provider status

  // OIDC Specific Fields (Managed by Better-Auth)
  oidcConfig     String?  // JSON string containing issuer, clientId, clientSecret, etc.
  samlConfig     String?  // JSON string containing spMetadata, idpMetadata, etc.

  // Legacy/UI Specific Fields (Kept for UI convenience, synced with oidcConfig)
  issuer         String?
  authorizationEndpoint String?
  tokenEndpoint  String?
  userInfoEndpoint String?
  jwksEndpoint   String?

  // Credentials
  clientId       String?
  clientSecret   String?

  // Custom App Logic
  adapterId      String   // e.g. "authentik", "pocket-id"
  adapterConfig  String?  // JSON string storing the raw inputs used to generate the config (e.g. { "url": "...", "realm": "..." })
  name           String   // Display Name e.g. "Corporate Login"
  enabled        Boolean  @default(true)
  allowProvisioning Boolean @default(true) // Whether to create new users automatically

  userId         String? // Optional: If linked to a specific user (Account Linking) logic, usually null for global SSO

  createdAt      DateTime @default(now())
  updatedAt      DateTime @updatedAt
}


// Log-Eintrag für jeden Prüfzyklus (wird regelmäßig bereinigt)
model HealthCheckLog {
  id              String        @id @default(uuid())
  adapterConfigId String
  status          String        // ONLINE, DEGRADED, OFFLINE
  latencyMs       Int           // Antwortzeit in Millisekunden
  error           String?       // Fehlermeldung falls fehlgeschlagen
  createdAt       DateTime      @default(now())

  adapterConfig   AdapterConfig @relation(fields: [adapterConfigId], references: [id], onDelete: Cascade)

  @@index([adapterConfigId, createdAt])
}

// Persistent history of database engine version changes detected by the
// "Update Database Versions" system task. One row is inserted only when the
// detected version differs from the latest stored entry for the same source.
model DbVersionHistory {
  id              String        @id @default(uuid())
  adapterConfigId String
  previousVersion String?       // null for the first recorded entry per source
  newVersion      String
  edition         String?       // optional adapter-specific info (e.g. MSSQL edition)
  detectedAt      DateTime      @default(now())

  adapterConfig   AdapterConfig @relation(fields: [adapterConfigId], references: [id], onDelete: Cascade)

  @@index([adapterConfigId, detectedAt])
}

model AuditLog {
  id          String   @id @default(uuid())
  userId      String?  // Nullable because some actions might be system actions or deleted users
  user        User?    @relation(fields: [userId], references: [id], onDelete: SetNull)

  action      String   // ENUM-like string: "LOGIN", "CREATE", "UPDATE", "DELETE"
  resource    String   // ENUM-like string: "USER", "JOB", "SOURCE", "DESTINATION", "SETTINGS"
  resourceId  String?  // The ID of the affected object

  details     String?  // JSON string storing changes (diff) or connection info
  ipAddress   String?
  userAgent   String?

  createdAt   DateTime @default(now())

  @@index([userId])
  @@index([resource])
  @@index([createdAt])
}

model ApiKey {
  id          String    @id @default(uuid())
  name        String
  prefix      String    // First 16 chars of raw key for UI identification (e.g. "dbackup_a3f2b1c8")
  hashedKey   String    @unique // SHA-256 hash of the full key
  permissions String    // JSON array of permission strings (same format as Group.permissions)
  userId      String
  user        User      @relation(fields: [userId], references: [id], onDelete: Cascade)
  expiresAt   DateTime? // Optional expiration date
  lastUsedAt  DateTime? // Updated on each successful authentication
  enabled     Boolean   @default(true)
  createdAt   DateTime  @default(now())

  @@index([hashedKey])
  @@index([userId])
}

model StorageSnapshot {
  id              String   @id @default(uuid())
  adapterConfigId String
  adapterName     String
  adapterId       String   // e.g. "local", "s3", "dropbox"
  size            BigInt   @default(0)
  count           Int      @default(0)
  createdAt       DateTime @default(now())

  @@index([adapterConfigId])
  @@index([createdAt])
}

// Tracks every notification sent through any adapter (per-job or system)
model NotificationLog {
  id              String   @id @default(uuid())
  eventType       String   // e.g. "backup_success", "user_login"
  channelId       String?  // AdapterConfig.id (nullable if channel was deleted)
  channelName     String   // Display name snapshot at send time
  adapterId       String   // e.g. "discord", "email", "slack"
  status          String   // "Success" | "Failed"
  title           String   // Notification title / email subject
  message         String   // Plain text body
  fields          String?  // JSON array of { name, value, inline? }
  color           String?  // Hex color used
  renderedHtml    String?  // Pre-rendered HTML (email only)
  renderedPayload String?  // JSON of adapter-specific payload (Discord embed, Slack blocks, etc.)
  error           String?  // Error message if failed
  executionId     String?  // Link to Execution if triggered by backup/restore
  sentAt          DateTime @default(now())

  @@index([eventType])
  @@index([adapterId])
  @@index([sentAt])
  @@index([executionId])
}

model StorageListCache {
  adapterConfigId String        @id
  filesJson       String
  cachedAt        DateTime      @default(now())
  adapterConfig   AdapterConfig @relation(fields: [adapterConfigId], references: [id], onDelete: Cascade)
}