@simple-auth-kit/cli 1.0.0

package/registry/combos/nestjs-prisma/variants/workspaces/prisma/schema/simple-auth-kit.prisma

@@ -0,0 +1,521 @@
+// A user belongs to any number of workspaces and carries a different set of roles in each, so
+// every authorization-bearing row hangs off the *membership*, never off the user:
+// `WorkspaceMember` is the principal for authorization, `User` is the principal for
+// authentication. Sessions and the access token stay user-level and workspace-agnostic — a
+// request names the workspace it acts in (X-Workspace-Id), and the guard resolves the
+// membership's permissions from the database on that request.
+// This is one file among possibly several under prisma/schema/ — Prisma's multi-file schema
+// support (stable since well before the version this repo pins) merges every .prisma file in
+// that folder into one logical schema automatically. Named simple-auth-kit.prisma specifically
+// so a consumer's own models, added as a sibling file in this same folder, are picked up by
+// `prisma generate`/`migrate` too, without the CLI ever touching that sibling file — it only
+// ever manages this one, by its exact name.
+//
+// `output` stays relative to *this file's own location*, which differs by context: the
+// registry's own dev/typecheck loop (scripts/materialize.mjs) keeps prisma/ as a sibling of
+// src/, so "../../generated/prisma" (two levels up from prisma/schema/) lands next to src/,
+// matching every "../generated/prisma/client.js" import there. A real CLI install moves
+// prisma.config.ts + prisma/ to the project root while src/ stays nested inside the merged
+// auth-lib directory — the CLI rewrites those same import strings in the copied files to match
+// (see installMerge's extraRewrites in cli/simple-auth-kit.ts), rather than this field trying to
+// be two things at once.
+generator client {
+  provider = "prisma-client"
+  output   = "../../generated/prisma"
+}
+
+datasource db {
+  provider = "postgresql"
+}
+
+/// `isActive: false` suspends a workspace without deleting it — every membership and role
+/// inside it survives. `isDeleted` is the harder off-switch.
+model Workspace {
+  id            BigInt    @id @default(autoincrement())
+  uuid          String    @unique @default(uuid())
+  name          String
+  isActive      Boolean   @default(true) @map("is_active")
+  createdBy     BigInt?   @map("created_by")
+  updatedBy     BigInt?   @map("updated_by")
+  isDeleted     Boolean   @default(false) @map("is_deleted")
+  deletedAt     DateTime? @map("deleted_at") @db.Timestamptz(6)
+  deletedBy     BigInt?   @map("deleted_by")
+  deletedReason String?   @map("deleted_reason") @db.VarChar(255)
+  createdAt     DateTime  @default(now()) @map("created_at") @db.Timestamptz(6)
+  updatedAt     DateTime  @updatedAt @map("updated_at") @db.Timestamptz(6)
+
+  members   WorkspaceMember[]
+  roles     Role[]
+  countries Country[]
+  languages Language[]
+  customers Customer[]
+
+  createdByUser User? @relation("WorkspaceCreatedBy", fields: [createdBy], references: [id], onDelete: SetNull)
+  updatedByUser User? @relation("WorkspaceUpdatedBy", fields: [updatedBy], references: [id], onDelete: SetNull)
+  deletedByUser User? @relation("WorkspaceDeletedBy", fields: [deletedBy], references: [id], onDelete: SetNull)
+
+  @@index([isActive], map: "workspaces_is_active_idx")
+  @@index([isDeleted], map: "workspaces_is_deleted_idx")
+  @@map("workspaces")
+}
+
+/// The authorization principal. `[userId, workspaceId]` is unique, making the per-request
+/// membership lookup a single indexed read.
+model WorkspaceMember {
+  id          BigInt   @id @default(autoincrement())
+  uuid        String   @unique @default(uuid())
+  userId      BigInt   @map("user_id")
+  workspaceId BigInt   @map("workspace_id")
+  createdAt   DateTime @default(now()) @map("created_at") @db.Timestamptz(6)
+
+  user        User               @relation(fields: [userId], references: [id])
+  workspace   Workspace          @relation(fields: [workspaceId], references: [id])
+  roles       RoleMember[]
+  permissions PermissionMember[]
+
+  @@unique([userId, workspaceId])
+  @@index([workspaceId], map: "workspace_members_workspace_id_idx")
+  @@map("workspace_members")
+}
+
+/// Authentication only. Deliberately has no roles — a user who is an admin in one workspace and
+/// a plain member in another has no single global role.
+model User {
+  id               BigInt    @id @default(autoincrement())
+  uuid             String    @unique @default(uuid())
+  email            String    @unique
+  firstName        String?   @unique @map("first_name")
+  lastName         String?   @unique @map("last_name")
+  displayName      String?   @map("display_name")
+  phone            String?   @unique
+  username         String?   @unique
+  photo            String?
+  lastLogin        DateTime? @map("last_login") @db.Timestamptz(6)
+  passwordHash     String?   @map("password_hash") // nullable: OAuth-only signup has no password
+  // Two independent reasons an account can't authenticate, tracked separately so an admin can see
+  // *why*: `blocked` is a security/moderation action (see `block()`/`unblock()`); `isActive` is a
+  // routine administrative on/off toggle (see `activate()`/`deactivate()`) — e.g. paused while an
+  // employee is on leave, with no implication of wrongdoing. Both deny login on their own; neither
+  // implies the other, and unblocking a blocked-but-inactive account still leaves it inactive.
+  blocked          Boolean   @default(false)
+  isActive         Boolean   @default(true) @map("is_active")
+  twoFactorEnabled Boolean   @default(false) @map("two_factor_enabled")
+  twoFactorSecret  String?   @map("two_factor_secret") // base32 TOTP secret; plaintext-at-rest
+  createdBy        BigInt?   @map("created_by")
+  updatedBy        BigInt?   @map("updated_by")
+  isDeleted        Boolean   @default(false) @map("is_deleted")
+  deletedAt        DateTime? @map("deleted_at") @db.Timestamptz(6)
+  deletedBy        BigInt?   @map("deleted_by")
+  deletedReason    String?   @map("deleted_reason") @db.VarChar(255)
+  createdAt        DateTime  @default(now()) @map("created_at") @db.Timestamptz(6)
+  updatedAt        DateTime  @updatedAt @map("updated_at") @db.Timestamptz(6)
+
+  memberships          WorkspaceMember[]
+  sessions             Session[]             @relation("UserSessions")
+  oauthAccounts        OAuthAccount[]
+  passwordResetTokens  PasswordResetToken[]
+  twoFactorBackupCodes TwoFactorBackupCode[]
+
+  // Named relations: Session/Role/Permission/Workspace each point at User multiple times, so
+  // Prisma needs an explicit name per back-reference.
+  revokedSessions Session[] @relation("UserRevokedSessions")
+  createdSessions Session[] @relation("SessionCreatedBy")
+  updatedSessions Session[] @relation("SessionUpdatedBy")
+  deletedSessions Session[] @relation("SessionDeletedBy")
+
+  createdByUser User?  @relation("UserCreatedBy", fields: [createdBy], references: [id], onDelete: SetNull)
+  usersCreated  User[] @relation("UserCreatedBy")
+  updatedByUser User?  @relation("UserUpdatedBy", fields: [updatedBy], references: [id], onDelete: SetNull)
+  usersUpdated  User[] @relation("UserUpdatedBy")
+  deletedByUser User?  @relation("UserDeletedBy", fields: [deletedBy], references: [id], onDelete: SetNull)
+  usersDeleted  User[] @relation("UserDeletedBy")
+
+  rolesCreated       Role[]       @relation("RoleCreatedBy")
+  rolesUpdated       Role[]       @relation("RoleUpdatedBy")
+  rolesDeleted       Role[]       @relation("RoleDeletedBy")
+  permissionsCreated Permission[] @relation("PermissionCreatedBy")
+  permissionsUpdated Permission[] @relation("PermissionUpdatedBy")
+  permissionsDeleted Permission[] @relation("PermissionDeletedBy")
+  workspacesCreated  Workspace[]  @relation("WorkspaceCreatedBy")
+  workspacesUpdated  Workspace[]  @relation("WorkspaceUpdatedBy")
+  workspacesDeleted  Workspace[]  @relation("WorkspaceDeletedBy")
+
+  countriesCreated Country[] @relation("CountryCreatedBy")
+  countriesUpdated Country[] @relation("CountryUpdatedBy")
+  countriesDeleted Country[] @relation("CountryDeletedBy")
+
+  languagesCreated Language[] @relation("LanguageCreatedBy")
+  languagesUpdated Language[] @relation("LanguageUpdatedBy")
+  languagesDeleted Language[] @relation("LanguageDeletedBy")
+
+  customersCreated Customer[] @relation("CustomerCreatedBy")
+  customersUpdated Customer[] @relation("CustomerUpdatedBy")
+  customersDeleted Customer[] @relation("CustomerDeletedBy")
+
+  @@index([isDeleted], map: "users_is_deleted_idx")
+  @@map("users")
+}
+
+/// A named bundle of permissions, scoped per workspace — two workspaces may each define
+/// `billing-manager` with entirely different permissions. `slug` and `name` are each unique
+/// *within* a workspace, not globally: two workspaces defining a role called "Admin" is a core
+/// proven property of this variant. `isDefault` is what a new member is given. `isActive: false`
+/// suspends a role without deleting it; `isDeleted` removes it from every listing outright.
+model Role {
+  id            BigInt    @id @default(autoincrement())
+  uuid          String    @unique @default(uuid())
+  workspaceId   BigInt    @map("workspace_id")
+  slug          String    @db.VarChar(255)
+  name          String    @db.VarChar(255)
+  displayName   String    @map("display_name") @db.VarChar(255)
+  description   String?
+  isDefault     Boolean   @default(false) @map("is_default")
+  order         Int       @default(0)
+  isActive      Boolean   @default(true) @map("is_active")
+  createdBy     BigInt?   @map("created_by")
+  updatedBy     BigInt?   @map("updated_by")
+  isDeleted     Boolean   @default(false) @map("is_deleted")
+  deletedAt     DateTime? @map("deleted_at") @db.Timestamptz(6)
+  deletedBy     BigInt?   @map("deleted_by")
+  deletedReason String?   @map("deleted_reason") @db.VarChar(255)
+  createdAt     DateTime  @default(now()) @map("created_at") @db.Timestamptz(6)
+  updatedAt     DateTime  @updatedAt @map("updated_at") @db.Timestamptz(6)
+
+  workspace   Workspace        @relation(fields: [workspaceId], references: [id])
+  members     RoleMember[]
+  permissions PermissionRole[]
+
+  createdByUser User? @relation("RoleCreatedBy", fields: [createdBy], references: [id], onDelete: SetNull)
+  updatedByUser User? @relation("RoleUpdatedBy", fields: [updatedBy], references: [id], onDelete: SetNull)
+  deletedByUser User? @relation("RoleDeletedBy", fields: [deletedBy], references: [id], onDelete: SetNull)
+
+  @@unique([workspaceId, slug])
+  @@unique([workspaceId, name])
+  @@index([workspaceId, isDefault], map: "roles_workspace_default_idx")
+  @@index([isActive, order], map: "roles_active_order_idx")
+  @@index([isDeleted], map: "roles_is_deleted_idx")
+  @@map("roles")
+}
+
+/// One capability, identified by its `slug` (`users:read`, `members:manage`) — the same string
+/// used in `@CheckAbility` and `ability.can`. Not workspace-scoped: the same capabilities are
+/// reused across workspaces' role definitions; what differs per workspace is which roles carry
+/// them. `group`/`groupOrder`/`order` back the admin console's permission matrix. `isActive:
+/// false` switches a capability off deployment-wide; `isDeleted` removes it from every listing.
+model Permission {
+  id            BigInt    @id @default(autoincrement())
+  uuid          String    @unique @default(uuid())
+  slug          String    @unique @db.VarChar(255)
+  name          String    @db.VarChar(255)
+  displayName   String    @map("display_name") @db.VarChar(255)
+  description   String?
+  group         String    @default("General") @db.VarChar(255)
+  groupOrder    Int       @default(0) @map("group_order")
+  order         Int       @default(0)
+  isActive      Boolean   @default(true) @map("is_active")
+  createdBy     BigInt?   @map("created_by")
+  updatedBy     BigInt?   @map("updated_by")
+  isDeleted     Boolean   @default(false) @map("is_deleted")
+  deletedAt     DateTime? @map("deleted_at") @db.Timestamptz(6)
+  deletedBy     BigInt?   @map("deleted_by")
+  deletedReason String?   @map("deleted_reason") @db.VarChar(255)
+  createdAt     DateTime  @default(now()) @map("created_at") @db.Timestamptz(6)
+  updatedAt     DateTime  @updatedAt @map("updated_at") @db.Timestamptz(6)
+
+  roles   PermissionRole[]
+  members PermissionMember[]
+
+  createdByUser User? @relation("PermissionCreatedBy", fields: [createdBy], references: [id], onDelete: SetNull)
+  updatedByUser User? @relation("PermissionUpdatedBy", fields: [updatedBy], references: [id], onDelete: SetNull)
+  deletedByUser User? @relation("PermissionDeletedBy", fields: [deletedBy], references: [id], onDelete: SetNull)
+
+  @@index([isActive], map: "permissions_is_active_idx")
+  @@index([group, groupOrder, order], map: "permissions_group_order_idx")
+  @@index([isDeleted], map: "permissions_is_deleted_idx")
+  @@map("permissions")
+}
+
+/// Which roles a membership holds. Because `Role` carries `workspaceId`, a membership cannot be
+/// assigned a role belonging to another workspace.
+model RoleMember {
+  memberId  BigInt   @map("member_id")
+  roleId    BigInt   @map("role_id")
+  createdAt DateTime @default(now()) @map("created_at") @db.Timestamptz(6)
+  updatedAt DateTime @updatedAt @map("updated_at") @db.Timestamptz(6)
+
+  member WorkspaceMember @relation(fields: [memberId], references: [id], onDelete: Cascade)
+  role   Role            @relation(fields: [roleId], references: [id], onDelete: Cascade)
+
+  @@id([memberId, roleId])
+  @@index([roleId], map: "role_member_role_id_idx")
+  @@map("role_member")
+}
+
+/// What each role carries.
+model PermissionRole {
+  permissionId BigInt   @map("permission_id")
+  roleId       BigInt   @map("role_id")
+  createdAt    DateTime @default(now()) @map("created_at") @db.Timestamptz(6)
+  updatedAt    DateTime @updatedAt @map("updated_at") @db.Timestamptz(6)
+
+  permission Permission @relation(fields: [permissionId], references: [id], onDelete: Cascade)
+  role       Role       @relation(fields: [roleId], references: [id], onDelete: Cascade)
+
+  @@id([permissionId, roleId])
+  @@index([roleId], map: "permission_role_role_id_idx")
+  @@map("permission_role")
+}
+
+/// Direct permission grants, additive to the membership's roles. Attached to the *membership*,
+/// not the user, so a grant made inside one workspace doesn't follow the person into another.
+model PermissionMember {
+  memberId     BigInt   @map("member_id")
+  permissionId BigInt   @map("permission_id")
+  createdAt    DateTime @default(now()) @map("created_at") @db.Timestamptz(6)
+  updatedAt    DateTime @updatedAt @map("updated_at") @db.Timestamptz(6)
+
+  member     WorkspaceMember @relation(fields: [memberId], references: [id], onDelete: Cascade)
+  permission Permission      @relation(fields: [permissionId], references: [id], onDelete: Cascade)
+
+  @@id([memberId, permissionId])
+  @@index([permissionId], map: "permission_member_permission_id_idx")
+  @@map("permission_member")
+}
+
+/// Links a social-login identity to a User. `[provider, providerAccountId]` is the OIDC `sub`
+/// claim; one User can have several, one per provider.
+model OAuthAccount {
+  id                BigInt   @id @default(autoincrement())
+  uuid              String   @unique @default(uuid())
+  userId            BigInt   @map("user_id")
+  provider          String   @db.VarChar(100)
+  providerAccountId String   @map("provider_account_id")
+  email             String?
+  createdAt         DateTime @default(now()) @map("created_at") @db.Timestamptz(6)
+
+  user User @relation(fields: [userId], references: [id])
+
+  @@unique([provider, providerAccountId])
+  @@index([userId], map: "oauth_accounts_user_id_idx")
+  @@map("oauth_accounts")
+}
+
+/// Single-use forgot-password tokens. Only `tokenHash` is stored, never the raw token.
+model PasswordResetToken {
+  id         BigInt    @id @default(autoincrement())
+  uuid       String    @unique @default(uuid())
+  userId     BigInt    @map("user_id")
+  tokenHash  String    @unique @map("token_hash")
+  expiresAt  DateTime  @map("expires_at") @db.Timestamptz(6)
+  consumedAt DateTime? @map("consumed_at") @db.Timestamptz(6)
+  createdAt  DateTime  @default(now()) @map("created_at") @db.Timestamptz(6)
+
+  user User @relation(fields: [userId], references: [id])
+
+  @@map("password_reset_tokens")
+}
+
+/// One-time 2FA recovery codes, issued when the user confirms TOTP enrollment.
+model TwoFactorBackupCode {
+  id       BigInt    @id @default(autoincrement())
+  uuid     String    @unique @default(uuid())
+  userId   BigInt    @map("user_id")
+  codeHash String    @map("code_hash")
+  usedAt   DateTime? @map("used_at") @db.Timestamptz(6)
+
+  user User @relation(fields: [userId], references: [id])
+
+  @@index([userId], map: "two_factor_backup_codes_user_id_idx")
+  @@map("two_factor_backup_codes")
+}
+
+/// Append-only event sink for `SessionStoreDeps.appendAuditEvent` (registry/core/session-policy.ts)
+/// plus the RBAC/2FA/OAuth/password-reset flows. `action` is the AuditEvent's discriminant and
+/// `info` the rest of its fields, so no schema change is needed when core adds event variants.
+/// The RBAC/User/Session tables also carry their own `createdBy`/`updatedBy`/`deletedBy` — a
+/// denormalized copy of the same fact, kept so a row-level "who touched this" read needs no join.
+model AuditLog {
+  id          BigInt   @id @default(autoincrement())
+  uuid        String   @unique @default(uuid())
+  workspaceId BigInt?  @map("workspace_id") // null for events outside any workspace (login, password reset, ...)
+  userId      BigInt?  @map("user_id") // who the event is about; null if not attributable to one user
+  name        String // human-readable label for `action`, e.g. "Role assigned"
+  action      String // AuditEvent discriminant, e.g. "role_assigned"
+  info        Json // the rest of the AuditEvent's fields
+  remarks     String? // free-text note
+  createdAt   DateTime @default(now()) @map("created_at") @db.Timestamptz(6)
+  updatedAt   DateTime @updatedAt @map("updated_at") @db.Timestamptz(6)
+
+  @@index([workspaceId, createdAt], map: "audit_logs_workspace_created_idx")
+  @@index([userId, createdAt], map: "audit_logs_user_created_idx")
+  @@index([createdAt], map: "audit_logs_created_idx")
+  @@map("audit_logs")
+}
+
+/// One row per logged-in device, independent of any workspace. Stores no usable credential:
+/// `currentRefreshJti` is the id of the currently-valid refresh token, not the token itself.
+/// `expiresAt` is an absolute cap set once at creation, never extended — `rotateRefreshToken`
+/// in core enforces it. `isRevoked` is derived from `revokedAt` by the repository, never set
+/// independently.
+model Session {
+  id                BigInt    @id @default(autoincrement())
+  uuid              String    @unique @default(uuid())
+  userId            BigInt    @map("user_id")
+  sessionVersion    Int       @default(0) @map("session_version")
+  currentRefreshJti String    @map("current_refresh_jti")
+  provider          String?   @db.VarChar(100) // OAuth provider this login came through; null for a password login
+  userAgent         String?   @map("user_agent")
+  ip                String?   @db.VarChar(100)
+  expiresAt         DateTime  @map("expires_at") @db.Timestamptz(6)
+  isRevoked         Boolean   @default(false) @map("is_revoked")
+  revokedAt         DateTime? @map("revoked_at") @db.Timestamptz(6)
+  revokedBy         BigInt?   @map("revoked_by")
+  revokedByIp       String?   @map("revoked_ip") @db.VarChar(100)
+  isActive          Boolean   @default(true) @map("is_active")
+  createdBy         BigInt?   @map("created_by")
+  updatedBy         BigInt?   @map("updated_by")
+  isDeleted         Boolean   @default(false) @map("is_deleted")
+  deletedAt         DateTime? @map("deleted_at") @db.Timestamptz(6)
+  deletedBy         BigInt?   @map("deleted_by")
+  deletedReason     String?   @map("deleted_reason") @db.VarChar(255)
+  createdAt         DateTime  @default(now()) @map("created_at") @db.Timestamptz(6)
+  updatedAt         DateTime  @updatedAt @map("updated_at") @db.Timestamptz(6)
+
+  user          User  @relation("UserSessions", fields: [userId], references: [id], onDelete: Cascade)
+  revokedByUser User? @relation("UserRevokedSessions", fields: [revokedBy], references: [id], onDelete: SetNull)
+  createdByUser User? @relation("SessionCreatedBy", fields: [createdBy], references: [id], onDelete: SetNull)
+  updatedByUser User? @relation("SessionUpdatedBy", fields: [updatedBy], references: [id], onDelete: SetNull)
+  deletedByUser User? @relation("SessionDeletedBy", fields: [deletedBy], references: [id], onDelete: SetNull)
+
+  @@index([userId], map: "sessions_user_id_idx")
+  @@index([isRevoked], map: "sessions_is_revoked_idx")
+  @@index([expiresAt], map: "sessions_expires_at_idx")
+  @@index([userId, isRevoked, expiresAt], map: "sessions_user_active_idx")
+  @@index([revokedBy], map: "sessions_revoked_by_idx")
+  @@map("sessions")
+}
+
+/// Instant access-token revocation. Rows are only ever as old as the access-token TTL (~15 min)
+/// — safe to move to Redis with a matching TTL without changing callers.
+model DenylistedAccessToken {
+  jti       String   @id
+  expiresAt DateTime @map("expires_at") @db.Timestamptz(6)
+
+  @@map("denylisted_access_tokens")
+}
+
+/// Admin-managed reference data — a workspace's country list. `flag` is a stored image path/URL,
+/// the same string-field convention `User.photo` already uses (no multipart upload in this combo).
+/// Scoped per workspace: `code`/`isoCode` are unique *within* a workspace, not globally — two
+/// workspaces may each define "US".
+model Country {
+  id            BigInt    @id @default(autoincrement())
+  uuid          String    @unique @default(uuid())
+  workspaceId   BigInt    @map("workspace_id")
+  code          String    @db.VarChar(10)
+  name          String    @db.VarChar(100)
+  emoji         String    @db.VarChar(10)
+  phoneCode     String    @map("phone_code") @db.VarChar(10)
+  currency      String    @db.VarChar(10)
+  currencyName  String    @map("currency_name") @db.VarChar(100)
+  isoCode       String    @map("iso_code") @db.VarChar(10)
+  flag          String?
+  isActive      Boolean   @default(true) @map("is_active")
+  createdBy     BigInt?   @map("created_by")
+  updatedBy     BigInt?   @map("updated_by")
+  isDeleted     Boolean   @default(false) @map("is_deleted")
+  deletedAt     DateTime? @map("deleted_at") @db.Timestamptz(6)
+  deletedBy     BigInt?   @map("deleted_by")
+  deletedReason String?   @map("deleted_reason") @db.VarChar(255)
+  createdAt     DateTime  @default(now()) @map("created_at") @db.Timestamptz(6)
+  updatedAt     DateTime  @updatedAt @map("updated_at") @db.Timestamptz(6)
+
+  workspace Workspace @relation(fields: [workspaceId], references: [id])
+
+  createdByUser User? @relation("CountryCreatedBy", fields: [createdBy], references: [id], onDelete: SetNull)
+  updatedByUser User? @relation("CountryUpdatedBy", fields: [updatedBy], references: [id], onDelete: SetNull)
+  deletedByUser User? @relation("CountryDeletedBy", fields: [deletedBy], references: [id], onDelete: SetNull)
+
+  @@unique([workspaceId, code])
+  @@unique([workspaceId, isoCode])
+  @@index([isActive], map: "countries_is_active_idx")
+  @@index([isDeleted], map: "countries_is_deleted_idx")
+  @@map("countries")
+}
+
+/// Admin-managed reference data — a workspace's supported languages. Deliberately no `countryId`
+/// FK: the UI this backend mirrors has no country field on the language form. Scoped per
+/// workspace: `code` is unique *within* a workspace, not globally.
+model Language {
+  id            BigInt    @id @default(autoincrement())
+  uuid          String    @unique @default(uuid())
+  workspaceId   BigInt    @map("workspace_id")
+  code          String    @db.VarChar(10)
+  name          String    @db.VarChar(100)
+  nativeName    String    @map("native_name") @db.VarChar(100)
+  direction     String    @default("ltr") @db.VarChar(3)
+  isDefault     Boolean   @default(false) @map("is_default")
+  isActive      Boolean   @default(true) @map("is_active")
+  createdBy     BigInt?   @map("created_by")
+  updatedBy     BigInt?   @map("updated_by")
+  isDeleted     Boolean   @default(false) @map("is_deleted")
+  deletedAt     DateTime? @map("deleted_at") @db.Timestamptz(6)
+  deletedBy     BigInt?   @map("deleted_by")
+  deletedReason String?   @map("deleted_reason") @db.VarChar(255)
+  createdAt     DateTime  @default(now()) @map("created_at") @db.Timestamptz(6)
+  updatedAt     DateTime  @updatedAt @map("updated_at") @db.Timestamptz(6)
+
+  workspace Workspace @relation(fields: [workspaceId], references: [id])
+
+  createdByUser User? @relation("LanguageCreatedBy", fields: [createdBy], references: [id], onDelete: SetNull)
+  updatedByUser User? @relation("LanguageUpdatedBy", fields: [updatedBy], references: [id], onDelete: SetNull)
+  deletedByUser User? @relation("LanguageDeletedBy", fields: [deletedBy], references: [id], onDelete: SetNull)
+
+  @@unique([workspaceId, code])
+  @@index([isActive], map: "languages_is_active_idx")
+  @@index([isDeleted], map: "languages_is_deleted_idx")
+  @@map("languages")
+}
+
+/// End-users managed by admins within a workspace — no login capability, and deliberately not
+/// related to the RBAC `User` model above (which plays this deployment's "admin"). A `Customer`
+/// never authenticates, so it carries no password/session/role relations at all. Scoped per
+/// workspace: `username`/`email`/`phone` are unique *within* a workspace, not globally.
+model Customer {
+  id              BigInt    @id @default(autoincrement())
+  uuid            String    @unique @default(uuid())
+  workspaceId     BigInt    @map("workspace_id")
+  firstName       String?   @map("first_name") @db.VarChar(100)
+  lastName        String?   @map("last_name") @db.VarChar(100)
+  username        String?   @db.VarChar(100)
+  email           String    @db.VarChar(255)
+  phone           String?   @db.VarChar(100)
+  dob             DateTime? @db.Date
+  gender          String?   @db.VarChar(10)
+  joinedDate      DateTime  @default(now()) @map("joined_date") @db.Date
+  photo           String?
+  isEmailVerified Boolean   @default(false) @map("is_email_verified")
+  isPhoneVerified Boolean   @default(false) @map("is_phone_verified")
+  isActive        Boolean   @default(true) @map("is_active")
+  createdBy       BigInt?   @map("created_by")
+  updatedBy       BigInt?   @map("updated_by")
+  isDeleted       Boolean   @default(false) @map("is_deleted")
+  deletedAt       DateTime? @map("deleted_at") @db.Timestamptz(6)
+  deletedBy       BigInt?   @map("deleted_by")
+  deletedReason   String?   @map("deleted_reason") @db.VarChar(255)
+  createdAt       DateTime  @default(now()) @map("created_at") @db.Timestamptz(6)
+  updatedAt       DateTime  @updatedAt @map("updated_at") @db.Timestamptz(6)
+
+  workspace Workspace @relation(fields: [workspaceId], references: [id])
+
+  createdByUser User? @relation("CustomerCreatedBy", fields: [createdBy], references: [id], onDelete: SetNull)
+  updatedByUser User? @relation("CustomerUpdatedBy", fields: [updatedBy], references: [id], onDelete: SetNull)
+  deletedByUser User? @relation("CustomerDeletedBy", fields: [deletedBy], references: [id], onDelete: SetNull)
+
+  @@unique([workspaceId, username])
+  @@unique([workspaceId, email])
+  @@unique([workspaceId, phone])
+  @@index([isActive], map: "customers_is_active_idx")
+  @@index([isDeleted], map: "customers_is_deleted_idx")
+  @@map("customers")
+}