@de-otio/trellis 0.6.0 → 0.7.0

package/prisma/schema.prisma

@@ -15,6 +15,8 @@ datasource db {
 // NO tenantId - schema-per-tenant provides isolation
 model Entity {
   id         String  @id @default(cuid())
+  // Multi-tenancy (v0.7) — every entity belongs to exactly one tenant.
+  tenantId   String  @map("tenant_id")
   name       String
   entityType String? @map("entity_type") // 'pet', 'product', 'event', etc. (defaults to 'dog' for MVP)
   metadata   Json? // Flexible schema for entity-specific fields (breed, bio, birthdate, breedSize, etc.)
@@ -41,7 +43,7 @@ model Entity {
   updatedAt DateTime @updatedAt @map("updated_at")
 
   // Co-ownership (replaces single ownerId)
-  owners       EntityOwnership[]
+  owners EntityOwnership[]
   // Relationships and follower counts live in the graph DB (AuraDB), not Prisma
 
   subjectPosts PostSubject[]
@@ -50,6 +52,10 @@ model Entity {
 
   connectionCodes ConnectionCode[]
 
+  tenant Tenant @relation(fields: [tenantId], references: [id], onDelete: Cascade)
+
+  @@index([tenantId])
+  @@index([tenantId, entityType, status])
   @@index([status])
   @@index([entityType, status])
   @@map("entities")
@@ -133,8 +139,10 @@ model User {
   suspended       Boolean   @default(false)
   suspendedAt     DateTime? @map("suspended_at")
   suspendedReason String?   @map("suspended_reason")
-  partnerId       String?
-  partner         Partner?  @relation(fields: [partnerId], references: [id])
+
+  // Multi-tenancy (v0.7) — user's auto-created personal tenant.
+  // Nullable to allow brief moments during sign-up before personal tenant exists.
+  personalTenantId String? @unique @map("personal_tenant_id")
 
   // Account Deletion Grace Period
   deletionRequestedAt DateTime? @map("deletion_requested_at") // When user requested deletion
@@ -267,8 +275,8 @@ model User {
   guardianLinks ParentalLink[] @relation("GuardianParentalLinks")
 
   // Safer Social Design: Quiet hours (Phase 2)
-  quietHoursStart   Int?    @map("quiet_hours_start")   // minutes from midnight (e.g., 1320 = 10PM)
-  quietHoursEnd     Int?    @map("quiet_hours_end")     // minutes from midnight (e.g., 420 = 7AM)
+  quietHoursStart   Int?    @map("quiet_hours_start") // minutes from midnight (e.g., 1320 = 10PM)
+  quietHoursEnd     Int?    @map("quiet_hours_end") // minutes from midnight (e.g., 420 = 7AM)
   quietHoursEnabled Boolean @default(false) @map("quiet_hours_enabled")
 
   // Safer Social Design: Profile visibility and DM access (Phase 5)
@@ -283,11 +291,17 @@ model User {
   createdConnectionCodes  ConnectionCode[]           @relation("ConnectionCodeCreator")
   redeemedConnectionCodes ConnectionCodeRedemption[]
 
+  // Multi-tenancy relations (v0.7)
+  personalTenant       Tenant?            @relation("PersonalTenantOwner")
+  tenantMemberships    TenantMember[]     @relation("TenantMemberships")
+  invitedTenantMembers TenantMember[]     @relation("TenantInvitedBy")
+  sentInvitations      TenantInvitation[] @relation("TenantInvitationInviter")
+  acceptedInvitations  TenantInvitation[] @relation("TenantInvitationAcceptedBy")
+
   @@index([role])
   @@index([region])
   @@index([dataRegion])
   @@index([suspended])
-  @@index([partnerId])
   @@index([username])
   @@index([emailVerified])
   @@index([identityVerified])
@@ -298,6 +312,7 @@ model User {
   @@index([emailHash]) // Index for email hash lookups
   @@index([anonymousId]) // Index for anonymous ID lookups
   @@index([cognitoSub]) // Index for Cognito sub lookups
+  @@index([personalTenantId])
   @@map("users")
 }
 
@@ -373,9 +388,9 @@ model CrossRegionConsent {
 // Posting radius — how far content radiates on the author's social graph
 enum PostRadius {
   WHISPER // Inner circle only (tier 0)
-  NORMAL  // Close friends + inner circle (tiers 0-1)
-  LOUD    // Community and closer (tiers 0-2)
-  SHOUT   // Everyone (all tiers)
+  NORMAL // Close friends + inner circle (tiers 0-1)
+  LOUD // Community and closer (tiers 0-2)
+  SHOUT // Everyone (all tiers)
 }
 
 // Privacy levels for follow relationships
@@ -387,30 +402,33 @@ enum Privacy {
 
 // Post model (unified for all visibility levels)
 model Post {
-  id              String              @id @default(cuid())
-  authorId        String              @map("author_id")
-  text            String              @db.Text
-  radius          PostRadius          @default(NORMAL)
-  geoData         Json?               @map("geo_data")
+  id              String     @id @default(cuid())
+  // Multi-tenancy (v0.7) — set to author's active tenant at write time.
+  tenantId        String     @map("tenant_id")
+  authorId        String     @map("author_id")
+  text            String     @db.Text
+  radius          PostRadius @default(NORMAL)
+  geoData         Json?      @map("geo_data")
   uri             String? // ActivityPub URI (for public posts)
-  contentWarnings String[]            @map("content_warnings")
-  deletedAt       DateTime?           @map("deleted_at")
-  hiddenByAuthor  Boolean             @default(false) @map("hidden_by_author")
-  createdAt       DateTime            @default(now()) @map("created_at")
-  updatedAt       DateTime            @updatedAt @map("updated_at")
-  editedAt        DateTime?           @map("edited_at") // Timestamp of last user edit (null if never edited)
-
-  author         User              @relation(fields: [authorId], references: [id])
-  group          Group?            @relation(fields: [groupId], references: [id])
-  groupId        String?           @map("group_id") // Group this post belongs to
-  media          PostMedia[]
-  sentiments     PostSentiment[]
-  comments       PostComment[]
+  contentWarnings String[]   @map("content_warnings")
+  deletedAt       DateTime?  @map("deleted_at")
+  hiddenByAuthor  Boolean    @default(false) @map("hidden_by_author")
+  createdAt       DateTime   @default(now()) @map("created_at")
+  updatedAt       DateTime   @updatedAt @map("updated_at")
+  editedAt        DateTime?  @map("edited_at") // Timestamp of last user edit (null if never edited)
+
+  author          User              @relation(fields: [authorId], references: [id])
+  tenant          Tenant            @relation(fields: [tenantId], references: [id], onDelete: Cascade)
+  group           Group?            @relation(fields: [groupId], references: [id])
+  groupId         String?           @map("group_id") // Group this post belongs to
+  media           PostMedia[]
+  sentiments      PostSentiment[]
+  comments        PostComment[]
   subjectEntities PostSubject[]
-  primaryEntityId String?       @map("primary_entity_id")
-  primaryEntity   Entity?       @relation("PrimaryEntityPosts", fields: [primaryEntityId], references: [id])
-  taxonomyTags   PostTaxonomyTag[]
-  linkChecks     LinkCheck[]
+  primaryEntityId String?           @map("primary_entity_id")
+  primaryEntity   Entity?           @relation("PrimaryEntityPosts", fields: [primaryEntityId], references: [id])
+  taxonomyTags    PostTaxonomyTag[]
+  linkChecks      LinkCheck[]
 
   // PREPARATORY CHANGE: Region tracking for China expansion
   // dataRegion: Where post data is stored (for compliance)
@@ -447,6 +465,7 @@ model Post {
   // Content category (optional classification)
   contentCategory String? @map("content_category")
 
+  @@index([tenantId, createdAt])
   @@index([authorId, createdAt])
   @@index([authorId, radius, createdAt])
   @@index([primaryEntityId])
@@ -596,6 +615,8 @@ model PostSentiment {
 // Post comments
 model PostComment {
   id                String   @id @default(cuid())
+  // Multi-tenancy (v0.7) — denormalized from the parent post; same scope.
+  tenantId          String   @map("tenant_id")
   postId            String   @map("post_id")
   postUri           String?  @map("post_uri")
   authorId          String   @map("author_id")
@@ -607,7 +628,7 @@ model PostComment {
 
   // Edit tracking
   editedAt     DateTime? @map("edited_at") // When last edited
-  originalText String?   @db.Text @map("original_text") // Preserve original on first edit
+  originalText String?   @map("original_text") @db.Text // Preserve original on first edit
 
   // Soft delete tracking
   deletedAt DateTime? @map("deleted_at") // When deleted (soft delete)
@@ -633,10 +654,12 @@ model PostComment {
   contentCategory String? @map("content_category")
 
   post       Post               @relation(fields: [postId], references: [id], onDelete: Cascade)
+  tenant     Tenant             @relation(fields: [tenantId], references: [id], onDelete: Cascade)
   media      PostCommentMedia[]
   sentiments CommentSentiment[]
   linkChecks LinkCheck[]
 
+  @@index([tenantId])
   @@index([postId, createdAt])
   @@index([postUri, createdAt])
   @@index([authorId])
@@ -709,13 +732,16 @@ model PostSubject {
   @@map("post_subjects")
 }
 
-// Security Events for SSO monitoring and compliance
+// Security Events for SSO monitoring and compliance.
+// In v0.7, this also serves as the audit-log substrate (T7 wires admin actions here).
 model SecurityEvent {
   id        String   @id @default(cuid())
-  type      String // sso_login, sso_failed, sso_config_error, rate_limit_exceeded, suspicious_activity, unauthorized_access
+  type      String // sso_login, sso_failed, sso_config_error, rate_limit_exceeded, suspicious_activity, unauthorized_access, tenant_*, member_*, idp_*, etc.
   severity  String // low, medium, high, critical
   userId    String?
-  partnerId String?
+  // Tenancy scope (v0.7) — replaces the old `partnerId` field.
+  // Nullable because some events (system-level) have no tenant context.
+  tenantId  String?  @map("tenant_id")
   ipAddress String?  @map("ip_address")
   userAgent String?  @map("user_agent")
   details   String // JSON string
@@ -727,31 +753,18 @@ model SecurityEvent {
   // Retention periods: critical=365 days, high=90 days, medium=30 days, low=7 days
   retentionUntil DateTime? @map("retention_until")
 
-  user    User?    @relation(fields: [userId], references: [id])
-  partner Partner? @relation(fields: [partnerId], references: [id])
+  user User? @relation(fields: [userId], references: [id])
 
   @@index([type])
   @@index([severity])
   @@index([timestamp])
   @@index([userId])
-  @@index([partnerId])
+  @@index([tenantId])
   @@index([ipAddress])
   @@index([retentionUntil]) // Index for efficient cleanup job queries
   @@map("security_events")
 }
 
-// Partner model for B2B SSO
-model Partner {
-  id        String   @id @default(cuid())
-  name      String
-  createdAt DateTime @default(now()) @map("created_at")
-
-  users          User[]
-  securityEvents SecurityEvent[]
-
-  @@map("partners")
-}
-
 // Feature Toggle model for global feature flags
 model FeatureToggle {
   id          String   @id @default(cuid())
@@ -942,10 +955,12 @@ model ProductTaxonomyTag {
 
 // Entity co-ownership — replaces single Entity.ownerId FK
 model EntityOwnership {
-  id       String          @id @default(cuid())
-  entityId String          @map("entity_id")
-  userId   String          @map("user_id")
-  role     OwnershipRole   @default(CO_OWNER)
+  id       String        @id @default(cuid())
+  // Multi-tenancy (v0.7) — denormalized from entity; same scope.
+  tenantId String        @map("tenant_id")
+  entityId String        @map("entity_id")
+  userId   String        @map("user_id")
+  role     OwnershipRole @default(CO_OWNER)
 
   addedByUserId String          @map("added_by_user_id")
   addedAt       DateTime        @default(now()) @map("added_at")
@@ -954,9 +969,11 @@ model EntityOwnership {
 
   entity  Entity @relation(fields: [entityId], references: [id], onDelete: Cascade)
   user    User   @relation("EntityOwners", fields: [userId], references: [id], onDelete: Cascade)
+  tenant  Tenant @relation(fields: [tenantId], references: [id], onDelete: Cascade)
   addedBy User   @relation("OwnershipAddedBy", fields: [addedByUserId], references: [id])
 
   @@unique([entityId, userId])
+  @@index([tenantId])
   @@index([entityId])
   @@index([userId])
   @@index([entityId, role])
@@ -965,8 +982,8 @@ model EntityOwnership {
 
 enum OwnershipRole {
   PRIMARY_OWNER // Full control, can transfer primary, can delete entity
-  CO_OWNER      // Post and manage, cannot delete entity
-  CARETAKER     // Can post about entity, cannot modify profile
+  CO_OWNER // Post and manage, cannot delete entity
+  CARETAKER // Can post about entity, cannot modify profile
 }
 
 enum OwnershipStatus {
@@ -985,13 +1002,13 @@ model CircleConfig {
   userId String @unique @map("user_id")
 
   // Tier thresholds (score >= threshold = in this tier)
-  innerThreshold       Float @default(0.8) @map("inner_threshold")       // tier 0
+  innerThreshold       Float @default(0.8) @map("inner_threshold") // tier 0
   closeFriendThreshold Float @default(0.5) @map("close_friend_threshold") // tier 1
-  communityThreshold   Float @default(0.2) @map("community_threshold")   // tier 2
+  communityThreshold   Float @default(0.2) @map("community_threshold") // tier 2
   // Below communityThreshold = ambient (tier 3)
 
   // View preferences
-  dailyDeckSize   Int? @map("daily_deck_size")    // null = no daily limit
+  dailyDeckSize   Int? @map("daily_deck_size") // null = no daily limit
   glanceLimit     Int  @default(20) @map("glance_limit") // Max items in glance mode
   depthWindowDays Int  @default(7) @map("depth_window_days") // How far back depth mode goes
 
@@ -1007,7 +1024,7 @@ model CircleConfig {
 model CircleReadState {
   id     String @id @default(cuid())
   userId String @map("user_id")
-  tier   Int    // 0 = inner, 1 = close friends, 2 = community, 3 = ambient
+  tier   Int // 0 = inner, 1 = close friends, 2 = community, 3 = ambient
 
   lastReadAt     DateTime @map("last_read_at")
   lastReadPostId String?  @map("last_read_post_id") // Cursor for pagination
@@ -1029,6 +1046,8 @@ model CircleReadState {
 // Group model for ActivityPub private groups
 model Group {
   id           String       @id @default(cuid())
+  // Multi-tenancy (v0.7) — group is owned by exactly one tenant.
+  tenantId     String       @map("tenant_id")
   name         String
   description  String?      @db.Text
   actorUri     String       @unique @map("actor_uri") // Group actor URI
@@ -1043,7 +1062,9 @@ model Group {
 
   members GroupMember[]
   posts   Post[]
+  tenant  Tenant        @relation(fields: [tenantId], references: [id], onDelete: Cascade)
 
+  @@index([tenantId])
   @@index([actorUri])
   @@index([privacy])
   @@map("groups")
@@ -1052,14 +1073,18 @@ model Group {
 // Group membership model
 model GroupMember {
   id       String    @id @default(cuid())
+  // Multi-tenancy (v0.7) — denormalized from group.
+  tenantId String    @map("tenant_id")
   groupId  String    @map("group_id")
   actorUri String    @map("actor_uri") // User's actor URI
   role     GroupRole
   joinedAt DateTime  @default(now()) @map("joined_at")
 
-  group Group @relation(fields: [groupId], references: [id], onDelete: Cascade)
+  group  Group  @relation(fields: [groupId], references: [id], onDelete: Cascade)
+  tenant Tenant @relation(fields: [tenantId], references: [id], onDelete: Cascade)
 
   @@unique([groupId, actorUri])
+  @@index([tenantId])
   @@index([groupId])
   @@index([actorUri])
   @@index([groupId, role])
@@ -1244,8 +1269,8 @@ model LinkReport {
 model EmailSuppression {
   id           String   @id @default(cuid())
   email        String   @unique
-  reason       String   // "bounce" | "complaint"
-  bounceType   String?  // "permanent" | "transient" for bounces
+  reason       String // "bounce" | "complaint"
+  bounceType   String? // "permanent" | "transient" for bounces
   suppressedAt DateTime @default(now())
   createdAt    DateTime @default(now())
   updatedAt    DateTime @updatedAt
@@ -1263,7 +1288,7 @@ model DeletionAuditLog {
   email        String
   requestedAt  DateTime  @map("requested_at")
   confirmedAt  DateTime? @map("confirmed_at")
-  completedAt  DateTime  @map("completed_at") @default(now())
+  completedAt  DateTime  @default(now()) @map("completed_at")
   itemsDeleted Json      @map("items_deleted")
   createdAt    DateTime  @default(now()) @map("created_at")
 
@@ -1278,22 +1303,22 @@ model DeletionAuditLog {
 // Age tiers for age-gated behavior
 enum AgeTier {
   CHILD // under 13
-  TEEN  // 13-17
+  TEEN // 13-17
   ADULT // 18+
 }
 
 // Profile visibility levels
 enum ProfileVisibility {
-  PUBLIC      // discoverable in search, visible to all
+  PUBLIC // discoverable in search, visible to all
   CONNECTIONS // visible only to mutual follows
-  PRIVATE     // visible only to self and guardian
+  PRIVATE // visible only to self and guardian
 }
 
 // DM access control
 enum DmAccess {
-  ANYONE      // anyone can DM
+  ANYONE // anyone can DM
   CONNECTIONS // only mutual follows
-  NOBODY      // DMs disabled
+  NOBODY // DMs disabled
 }
 
 // Parental link status
@@ -1339,6 +1364,8 @@ enum NotificationType {
 // Notification model (poll-based, never pushed)
 model Notification {
   id          String           @id @default(cuid())
+  // Multi-tenancy (v0.7) — set to recipient's active tenant at write time.
+  tenantId    String           @map("tenant_id")
   userId      String           @map("user_id")
   type        NotificationType
   title       String
@@ -1349,8 +1376,10 @@ model Notification {
   deliveredAt DateTime?        @map("delivered_at")
   batchId     String?          @map("batch_id")
 
-  user User @relation(fields: [userId], references: [id])
+  user   User   @relation(fields: [userId], references: [id])
+  tenant Tenant @relation(fields: [tenantId], references: [id], onDelete: Cascade)
 
+  @@index([tenantId, userId, read, createdAt])
   @@index([userId, read, createdAt])
   @@index([userId, batchId])
   @@map("notifications")
@@ -1358,8 +1387,8 @@ model Notification {
 
 // Notification preferences (safety and parental always enabled, not configurable)
 model NotificationPreference {
-  id            String  @id @default(cuid())
-  userId        String  @unique @map("user_id")
+  id                  String  @id @default(cuid())
+  userId              String  @unique @map("user_id")
   dmEnabled           Boolean @default(true) @map("dm_enabled")
   followEnabled       Boolean @default(true) @map("follow_enabled")
   digestEnabled       Boolean @default(true) @map("digest_enabled")
@@ -1375,6 +1404,8 @@ model NotificationPreference {
 // a relationship in the graph DB. Entity-scoped codes can be created by entity owners.
 model ConnectionCode {
   id        String   @id @default(cuid())
+  // Multi-tenancy (v0.7) — code's owning tenant (creator's active tenant at create time).
+  tenantId  String   @map("tenant_id")
   code      String   @unique
   creatorId String   @map("creator_id")
   entityId  String?  @map("entity_id")
@@ -1385,8 +1416,10 @@ model ConnectionCode {
 
   creator     User                       @relation("ConnectionCodeCreator", fields: [creatorId], references: [id])
   entity      Entity?                    @relation(fields: [entityId], references: [id])
+  tenant      Tenant                     @relation(fields: [tenantId], references: [id], onDelete: Cascade)
   redemptions ConnectionCodeRedemption[]
 
+  @@index([tenantId])
   @@index([creatorId, expiresAt])
   @@index([entityId])
   @@map("connection_codes")
@@ -1397,12 +1430,229 @@ model ConnectionCodeRedemption {
   id        String   @id @default(cuid())
   codeId    String   @map("code_id")
   userId    String   @map("user_id")
+  tenantId  String   @map("tenant_id")
   createdAt DateTime @default(now()) @map("created_at")
 
-  code ConnectionCode @relation(fields: [codeId], references: [id])
-  user User           @relation(fields: [userId], references: [id])
+  code   ConnectionCode @relation(fields: [codeId], references: [id])
+  user   User           @relation(fields: [userId], references: [id])
+  tenant Tenant         @relation(fields: [tenantId], references: [id], onDelete: Cascade)
 
   @@unique([codeId, userId])
   @@index([userId])
+  @@index([tenantId])
   @@map("connection_code_redemptions")
 }
+
+// ============================================================================
+// MULTI-TENANCY MODEL (added in v0.7 — see plans/mvp/10-trellis-stages/01-schema-migration.md)
+// ============================================================================
+
+model Tenant {
+  id          String       @id @default(cuid())
+  slug        String       @unique
+  displayName String       @map("display_name")
+  type        TenantType
+  status      TenantStatus @default(ACTIVE)
+
+  // Data-residency region for the tenant. Surfaced in the per-tenant
+  // compliance bundle (`/api/tenants/:id/compliance.json`). Defaults to
+  // "EU" since the platform's primary region is Frankfurt; tenants can
+  // elect a different region during onboarding.
+  region String @default("EU")
+
+  // For PERSONAL tenants only — the single owner. Always equals the User.id who created it.
+  personalOwnerUserId String? @unique @map("personal_owner_user_id")
+
+  createdAt     DateTime  @default(now()) @map("created_at")
+  updatedAt     DateTime  @updatedAt @map("updated_at")
+  suspendedAt   DateTime? @map("suspended_at")
+  suspendReason String?   @map("suspend_reason")
+
+  members          TenantMember[]
+  domains          TenantDomain[]
+  identityProvider TenantIdentityProvider?
+  roleMappings     TenantRoleMapping[]
+  invitations      TenantInvitation[]
+
+  // Tenant-scoped resources
+  entities                  Entity[]
+  posts                     Post[]
+  postComments              PostComment[]
+  groups                    Group[]
+  groupMembers              GroupMember[]
+  entityOwnerships          EntityOwnership[]
+  connectionCodes           ConnectionCode[]
+  connectionCodeRedemptions ConnectionCodeRedemption[]
+  notifications             Notification[]
+
+  // Personal-tenant owner back-relation (uses @relation name to disambiguate)
+  personalOwner User? @relation("PersonalTenantOwner", fields: [personalOwnerUserId], references: [id])
+
+  @@index([slug])
+  @@index([type, status])
+  @@map("tenants")
+}
+
+enum TenantType {
+  PERSONAL
+  ORGANIZATION
+}
+
+enum TenantStatus {
+  ACTIVE
+  SUSPENDED
+  DELETING // Phase 3 — soft state during cascade-delete
+}
+
+model TenantMember {
+  id       String             @id @default(cuid())
+  tenantId String             @map("tenant_id")
+  userId   String             @map("user_id")
+  role     TenantRole
+  status   TenantMemberStatus @default(ACTIVE)
+
+  isJitProvisioned Boolean   @default(false) @map("is_jit_provisioned")
+  invitedByUserId  String?   @map("invited_by_user_id")
+  invitedAt        DateTime? @map("invited_at")
+  joinedAt         DateTime? @map("joined_at")
+  removedAt        DateTime? @map("removed_at")
+  lastActiveAt     DateTime? @map("last_active_at")
+
+  tenant    Tenant @relation(fields: [tenantId], references: [id], onDelete: Cascade)
+  user      User   @relation("TenantMemberships", fields: [userId], references: [id], onDelete: Cascade)
+  invitedBy User?  @relation("TenantInvitedBy", fields: [invitedByUserId], references: [id])
+
+  @@unique([tenantId, userId])
+  @@index([userId])
+  @@index([tenantId, status])
+  @@index([tenantId, role])
+  @@map("tenant_members")
+}
+
+enum TenantRole {
+  OWNER
+  ADMIN
+  MEMBER
+  GUEST
+}
+
+enum TenantMemberStatus {
+  INVITED
+  ACTIVE
+  SUSPENDED
+  REMOVED
+}
+
+model TenantDomain {
+  id                String    @id @default(cuid())
+  tenantId          String    @map("tenant_id")
+  domain            String    @unique // lowercased; no protocol
+  verificationToken String    @map("verification_token") // 32 hex chars
+  // Token expires 7 days after creation; admin must re-claim if expired (sec finding #5)
+  tokenExpiresAt    DateTime  @map("token_expires_at")
+  verifiedAt        DateTime? @map("verified_at")
+  verifyAttemptedAt DateTime? @map("verify_attempted_at")
+  verifyAttempts    Int       @default(0) @map("verify_attempts")
+  createdAt         DateTime  @default(now()) @map("created_at")
+
+  tenant Tenant @relation(fields: [tenantId], references: [id], onDelete: Cascade)
+
+  @@index([tenantId])
+  @@index([verifiedAt])
+  @@index([tokenExpiresAt])
+  @@map("tenant_domains")
+}
+
+model TenantIdentityProvider {
+  id       String @id @default(cuid())
+  tenantId String @unique @map("tenant_id")
+
+  kind IdpKind
+
+  // Cognito's IdP record name. Max 32 chars (Cognito quota), unique within the user pool.
+  cognitoIdpName String @unique @map("cognito_idp_name")
+
+  // SAML configuration
+  metadataUrl String? @map("metadata_url")
+  metadataXml String? @map("metadata_xml") @db.Text
+
+  // OIDC configuration
+  issuerUrl       String? @map("issuer_url")
+  clientId        String? @map("client_id")
+  clientSecretArn String? @map("client_secret_arn") // never the raw secret — Secrets Manager ARN
+  scopes          String  @default("openid email profile groups")
+
+  attributeMapping Json @default("{}") @map("attribute_mapping")
+
+  // Default role applied when no TenantRoleMapping matches the user's IdP groups.
+  // null means "deny if no group match."
+  defaultRole TenantRole? @map("default_role")
+
+  status      IdpStatus @default(PENDING)
+  enabledAt   DateTime? @map("enabled_at")
+  lastError   String?   @map("last_error") @db.Text
+  lastErrorAt DateTime? @map("last_error_at")
+
+  createdAt DateTime @default(now()) @map("created_at")
+  updatedAt DateTime @updatedAt @map("updated_at")
+
+  tenant Tenant @relation(fields: [tenantId], references: [id], onDelete: Cascade)
+
+  @@index([cognitoIdpName])
+  @@index([status])
+  @@map("tenant_identity_providers")
+}
+
+enum IdpKind {
+  SAML
+  OIDC
+}
+
+enum IdpStatus {
+  PENDING
+  ACTIVE
+  DISABLED
+  ERROR
+}
+
+model TenantRoleMapping {
+  id           String     @id @default(cuid())
+  tenantId     String     @map("tenant_id")
+  idpGroupName String     @map("idp_group_name")
+  tenantRole   TenantRole @map("tenant_role")
+  // Lower priority = higher precedence (admin-grants beat member-grants).
+  priority     Int        @default(100)
+
+  createdAt DateTime @default(now()) @map("created_at")
+  updatedAt DateTime @updatedAt @map("updated_at")
+
+  tenant Tenant @relation(fields: [tenantId], references: [id], onDelete: Cascade)
+
+  @@unique([tenantId, idpGroupName])
+  @@index([tenantId, priority])
+  @@map("tenant_role_mappings")
+}
+
+model TenantInvitation {
+  id               String     @id @default(cuid())
+  tenantId         String     @map("tenant_id")
+  email            String
+  role             TenantRole
+  token            String     @unique // signed JWT or random opaque token; one-shot
+  expiresAt        DateTime   @map("expires_at")
+  acceptedAt       DateTime?  @map("accepted_at")
+  acceptedByUserId String?    @map("accepted_by_user_id")
+
+  invitedByUserId String   @map("invited_by_user_id")
+  createdAt       DateTime @default(now()) @map("created_at")
+
+  tenant     Tenant @relation(fields: [tenantId], references: [id], onDelete: Cascade)
+  invitedBy  User   @relation("TenantInvitationInviter", fields: [invitedByUserId], references: [id])
+  acceptedBy User?  @relation("TenantInvitationAcceptedBy", fields: [acceptedByUserId], references: [id])
+
+  @@unique([tenantId, email])
+  @@index([token])
+  @@index([email])
+  @@index([expiresAt])
+  @@map("tenant_invitations")
+}