create-ailk 0.1.0 → 0.2.0

package/templates/database/auth/schema.prisma

@@ -0,0 +1,521 @@
+// auth namespace — tenancy models (Organization, Workspace, Membership, Invitation)
+//
+// The multi-tenant module's Organization → Workspace → Membership layer
+// (FEAT-042). Per ADR 0009, the auth namespace's charter is identity + tenancy
+// membership, so these live beside User/Session — @relation to User is allowed
+// here (same namespace).
+//
+// Organization is the tenant boundary (members, billing, security key on
+// organizationId). Workspace is the working context (operational config + all
+// domain content key on workspaceId). Membership is org-level; workspace
+// visibility follows org membership (per-workspace ACL is a future additive
+// concern — do not add a workspace-member table without a new design pass).
+//
+// Organization / Membership / Invitation are managed by the Better Auth
+// organization plugin (apps/workspace auth config maps member → Membership via
+// modelName). Workspace is AILK's own model: the plugin's teams feature was
+// evaluated and rejected because setActiveTeam requires per-team membership
+// rows, contradicting org-level membership (see
+// docs/research/ploy-capture/lessons/better-auth-teams-rejected-for-workspaces.md).
+//
+// Generator + datasource blocks live in database/schema.prisma (the root schema
+// file). This file holds only model definitions for the auth-namespace tenancy
+// tables; the same models are registered in the root schema for generation.
+
+/// Role — membership role within an Organization. Hierarchy: owner > admin > member.
+/// Values are lowercase to match the Better Auth organization plugin's role
+/// strings ("owner" | "admin" | "member") so plugin writes pass Prisma enum
+/// validation unmapped. Distinct from User.role (a per-deployment String).
+enum Role {
+  owner
+  admin
+  member
+}
+
+/// Organization — the tenant boundary. Owns membership, billing, security.
+model Organization {
+  id        String   @id @default(dbgenerated("('org_'::text || (uuidv7())::text)")) @db.Text
+  name      String
+  slug      String   @unique
+  logo      String?
+  metadata  String?
+  createdAt DateTime @default(now()) @map("created_at")
+  updatedAt DateTime @updatedAt @map("updated_at")
+
+  // Org-level billing identity + tier/subscription projection (org-scoped
+  // billing, #3601). Mirrors the User billing shape (see User L134-144) at the
+  // Organization level: in a multi-tenant deployment the Organization is the
+  // billing entity (individuals are billed as orgs-of-one on their sentinel
+  // default Organization). The Stripe webhook is the only writer (see
+  // apps/api/src/routes/webhooks/stripe.ts, keyed on checkout
+  // metadata.organizationId). Single-tenant deployments keep User-scoped
+  // billing (User fields above) and never touch these.
+  billingProvider   String?  @map("billing_provider")     // "stripe"; provider-agnostic
+  billingCustomerId String?  @map("billing_customer_id")  // cus_xxx or equivalent
+  tier              String   @default("free")             // "free" | "pro" | "pro_plus" | "enterprise"
+  hasCarePlan       Boolean  @default(false) @map("has_care_plan")
+  seatCount         Int      @default(1) @map("seat_count")
+
+  // Usage-billing balance counters — the Company-counter live on-demand
+  // credit model (FEAT-047 P1.S2, #3710 — capture D6, NOT a CreditUsagePeriod
+  // ledger table). Same-namespace additions to the existing billing identity
+  // fields above — no new relation. Read/written by the credit waterfall
+  // (apps/api/src/services/usage-credits.ts, #3716, the sanctioned
+  // tenant-scope exception) and the entitlement resolver (P1.S3).
+  usageBillingEnabled        Boolean   @default(false) @map("usage_billing_enabled")
+  stripeUsageMeterItemId     String?   @map("stripe_usage_meter_item_id")
+  includedCreditsCents       Int       @default(0) @map("included_credits_cents")
+  includedCreditsUsedCents   Int       @default(0) @map("included_credits_used_cents")
+  onDemandLimitCents         Int?      @map("on_demand_limit_cents")
+  onDemandUsedCents          Int       @default(0) @map("on_demand_used_cents")
+  onDemandPrechargedCents    Int       @default(0) @map("on_demand_precharged_cents")
+  /// Carry-forward credit balance. DB CHECK `>= 0`
+  /// (`organizations_on_demand_credit_balance_non_negative`, migration
+  /// 20260714030000) — Prisma cannot model CHECK, so the migration is the
+  /// source of truth. Debited only via the credit waterfall's compare-and-swap
+  /// (apps/api/src/services/usage-credits.ts, #3730); a negative balance would
+  /// INVERT the debit and hand out free credits.
+  onDemandCreditBalanceCents Int       @default(0) @map("on_demand_credit_balance_cents")
+  creditsCycleEnd            DateTime? @map("credits_cycle_end")
+  limitAllocationMode        String    @default("COMPANY_WIDE") @map("limit_allocation_mode") // "COMPANY_WIDE" | "INDIVIDUAL"
+
+  memberships Membership[]
+  invitations Invitation[]
+  workspaces  Workspace[]
+
+  @@unique([billingProvider, billingCustomerId])
+  @@map("organizations")
+}
+
+/// Workspace — working context under an Organization. URL scope for all
+/// domain content; operational config keys on workspaceId. Flat (org →
+/// workspaces): no nesting — a future positioning-entity tree is a separate
+/// feature and must not require tenancy rework.
+model Workspace {
+  id             String   @id @default(dbgenerated("('wksp_'::text || (uuidv7())::text)")) @db.Text
+  organizationId String   @map("organization_id")
+  name           String
+  slug           String
+  createdAt      DateTime @default(now()) @map("created_at")
+  updatedAt      DateTime @updatedAt @map("updated_at")
+
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+
+  @@unique([organizationId, slug])
+  @@index([organizationId])
+  @@map("workspaces")
+}
+
+/// Membership — User ↔ Organization with a Role. Managed by the Better Auth
+/// organization plugin (modelName "membership"). Org-level: grants visibility
+/// into every workspace of the organization.
+model Membership {
+  id             String   @id @default(dbgenerated("('member_'::text || (uuidv7())::text)")) @db.Text
+  organizationId String   @map("organization_id")
+  userId         String   @map("user_id")
+  role           Role     @default(member)
+  createdAt      DateTime @default(now()) @map("created_at")
+
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  user         User         @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([organizationId, userId])
+  @@index([userId])
+  @@index([organizationId])
+  @@map("memberships")
+}
+
+/// Invitation — pending invite of an email address into an Organization.
+/// Managed by the Better Auth organization plugin. status:
+/// "pending" | "accepted" | "rejected" | "canceled".
+model Invitation {
+  id             String    @id @default(dbgenerated("('invite_'::text || (uuidv7())::text)")) @db.Text
+  organizationId String    @map("organization_id")
+  email          String
+  role           Role      @default(member)
+  status         String    @default("pending")
+  expiresAt      DateTime? @map("expires_at")
+  inviterId      String    @map("inviter_id")
+  createdAt      DateTime  @default(now()) @map("created_at")
+
+  organization Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  inviter      User         @relation("sent_invitations", fields: [inviterId], references: [id], onDelete: Cascade)
+
+  @@index([organizationId])
+  @@index([email])
+  @@map("invitations")
+}
+
+// ============================================================================
+// Usage-billing balances/subscription/plan (FEAT-047 P1.S2, #3710 — Epic
+// #3704). Per ADR 0009 D2 (roadmap §4), billing balances/subscription/plan
+// live in `auth` (identity+tenancy charter); pricing/markup/model config
+// lives in `config` (see database/config/schema.prisma). organizationId is a
+// plain String stable-id — no @relation to Organization, even though both
+// live in this namespace (spec D4: cross-namespace assembly + billing writes
+// are keyed on explicit id, not relation traversal — mirrors the sanctioned
+// usage-credits.ts / entitlements.ts / webhooks/stripe.ts read/write shape).
+// Field roster ported from docs/research/wt-billing-capture/schema.md.
+// ============================================================================
+
+/// Subscription — one per Organization; the plan link + Stripe subscription
+/// identity + enterprise contract terms. contractType/paymentMode are
+/// nullable — "enterprise contract fields" only apply to sales-assisted /
+/// enterprise deals; a self-serve subscription leaves them unset (no
+/// business default invented — see spec §5.3).
+model Subscription {
+  id             String @id @default(dbgenerated("('orgsub_'::text || (uuidv7())::text)")) @db.Text
+  organizationId String @unique @map("organization_id")
+  planId         String @map("plan_id")
+
+  stripeSubscriptionId String? @map("stripe_subscription_id")
+  stripePriceId        String? @map("stripe_price_id")
+  stripeCustomerId     String? @map("stripe_customer_id")
+
+  contractType       ContractType?            @map("contract_type")
+  netTermsDays       Int?                     @map("net_terms_days")
+  contractValueCents Int?                     @map("contract_value_cents")
+  paymentMode        SubscriptionPaymentMode? @map("payment_mode")
+
+  createdAt DateTime @default(now()) @map("created_at")
+  updatedAt DateTime @updatedAt @map("updated_at")
+
+  @@map("subscriptions")
+}
+
+/// Plan — the plan catalog (allowances, limits, Stripe price). Global
+/// (not org-scoped) — the definitions a Subscription.planId references by
+/// stable id, no @relation (spec D4).
+model Plan {
+  id    String @id @default(dbgenerated("('plan_'::text || (uuidv7())::text)")) @db.Text
+  slug  String @unique
+  tier  Int
+
+  baseTokens               Int     @map("base_tokens")
+  // Decimal, never Float: usageMultiplier scales a money amount. DOUBLE
+  // PRECISION admits NaN/Infinity, and NaN compares false against every
+  // spend-limit comparison — a float here fails OPEN past the limit gate.
+  // Matches the sibling money-multiplier convention (LlmModel.
+  // consumptionMultiplier, database/config/schema.prisma).
+  usageMultiplier          Decimal @map("usage_multiplier") @db.Decimal(5, 2)
+  isPooled                 Boolean @map("is_pooled")
+  monthlyDollarCreditCents Int     @map("monthly_dollar_credit_cents")
+
+  features Json
+  limits   Json
+
+  stripePriceId String? @map("stripe_price_id")
+
+  createdAt DateTime @default(now()) @map("created_at")
+  updatedAt DateTime @updatedAt @map("updated_at")
+
+  @@map("plans")
+}
+
+/// UsageSettings — one per Organization; the usage-based-billing opt-in +
+/// monthly spend-limit gate (read by the spend-limit check, P2).
+model UsageSettings {
+  id             String @id @default(dbgenerated("('usgset_'::text || (uuidv7())::text)")) @db.Text
+  organizationId String @unique @map("organization_id")
+
+  usageBasedBillingEnabled Boolean @default(false) @map("usage_based_billing_enabled")
+  monthlySpendLimitCents   Int?    @map("monthly_spend_limit_cents")
+
+  createdAt DateTime @default(now()) @map("created_at")
+  updatedAt DateTime @updatedAt @map("updated_at")
+
+  @@map("usage_settings")
+}
+
+
+// === Relocated from root schema.prisma (ADR-0009 D4 Phase 2, #3607) ===
+
+/// User - Dashboard users (site owners, admins, end-users)
+///
+/// emailVerified is a Boolean per Better Auth's contract (NextAuth previously
+/// stored the verification timestamp as DateTime?). The five custom relations
+/// — ApiToken, RefreshToken, OAuthAuthorization, PushToken, UserData — keep
+/// their onDelete: Cascade semantics so user removal cleanly tears down all
+/// dependent rows.
+model User {
+  id            String    @id @default(dbgenerated("('user_'::text || (uuidv7())::text)")) @db.Text
+  email         String    @unique
+  name          String?
+  image         String?
+  emailVerified Boolean   @default(false) @map("email_verified")
+
+  // Profile extensions
+  role          String    @default("user") // "user", "admin", "owner"
+
+  // Billing identity — provider-agnostic so Stripe is v1 value, not baked-in name.
+  // Webhook is the only writer (see apps/api/src/routes/webhooks/stripe.ts).
+  // #771 self-serve dashboard reads billingCustomerId for Stripe customer-portal URL.
+  billingProvider   String?  @map("billing_provider")    // "stripe"; future: "lemonsqueezy", "paddle"
+  billingCustomerId String?  @map("billing_customer_id") // cus_xxx (Stripe) or equivalent
+
+  // Subscription tier projection — derived from the Stripe webhook's product-aware
+  // routing (#898). Defaults to "free" until a customer.subscription.created event
+  // fires; flips to "pro" / "pro_plus" / etc. based on the line item's product.
+  // hasCarePlan is true only for pro_plus today; seatCount mirrors the line item
+  // quantity from Stripe's adjustable-quantity widget (1–50).
+  tier         String   @default("free")                  // "free" | "pro" | "pro_plus" | "enterprise" (retired "agency"/"commercial" rows migrated to "enterprise" — #3516)
+  hasCarePlan  Boolean  @default(false) @map("has_care_plan")
+  seatCount    Int      @default(1) @map("seat_count")
+
+  createdAt     DateTime  @default(now()) @map("created_at")
+  updatedAt     DateTime  @updatedAt @map("updated_at")
+
+  // Better Auth relations
+  sessions      Session[]
+  accounts      Account[]
+
+  // API & OAuth
+  apiTokens           ApiToken[]
+  refreshTokens       RefreshToken[]
+  oauthAuthorizations OAuthAuthorization[]
+  pushTokens          PushToken[]
+
+  // Extensions
+  userData      UserData[]
+
+  // Tenancy (multi-tenant module — database/auth/schema.prisma)
+  memberships     Membership[]
+  sentInvitations Invitation[] @relation("sent_invitations")
+
+  @@unique([billingProvider, billingCustomerId])
+  @@map("users")
+}
+
+/// Session - Active user sessions (Better Auth schema)
+///
+/// Session.token is the opaque cookie value the dual-mode preHandler reads.
+/// Deleting a row revokes the session; deleting the parent User cascades.
+model Session {
+  id        String   @id @default(dbgenerated("('sess_'::text || (uuidv7())::text)")) @db.Text
+  expiresAt DateTime @map("expires_at")
+  token     String   @unique
+  createdAt DateTime @default(now()) @map("created_at")
+  updatedAt DateTime @updatedAt @map("updated_at")
+  ipAddress String?  @map("ip_address")
+  userAgent String?  @map("user_agent")
+  userId    String   @map("user_id")
+
+  // Active tenant context (multi-tenant module). activeOrganizationId is the
+  // Better Auth organization plugin's session field; activeWorkspaceId is
+  // AILK's thin session extension (session.additionalFields in the
+  // apps/workspace auth config). Null in single-tenant deployments.
+  activeOrganizationId String? @map("active_organization_id")
+  activeWorkspaceId    String? @map("active_workspace_id")
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@index([userId])
+  @@index([token])
+  @@map("sessions")
+}
+
+/// Account - OAuth provider connections (Google, GitHub, etc.)
+///
+/// Better Auth's account shape: one row per (providerId, accountId) pair.
+/// Cascade on User removal keeps OAuth links from orphaning.
+model Account {
+  id                    String    @id @default(dbgenerated("('acct_'::text || (uuidv7())::text)")) @db.Text
+  accountId             String    @map("account_id")
+  providerId            String    @map("provider_id")
+  userId                String    @map("user_id")
+  accessToken           String?   @map("access_token") @db.Text
+  refreshToken          String?   @map("refresh_token") @db.Text
+  idToken               String?   @map("id_token") @db.Text
+  accessTokenExpiresAt  DateTime? @map("access_token_expires_at")
+  refreshTokenExpiresAt DateTime? @map("refresh_token_expires_at")
+  scope                 String?
+  password              String?
+  createdAt             DateTime  @default(now()) @map("created_at")
+  updatedAt             DateTime  @updatedAt @map("updated_at")
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([providerId, accountId])
+  @@index([userId])
+  @@map("accounts")
+}
+
+/// Verification - Email / magic-link verification tokens (Better Auth schema)
+model Verification {
+  id         String   @id @default(dbgenerated("('verify_'::text || (uuidv7())::text)")) @db.Text
+  identifier String
+  value      String
+  expiresAt  DateTime @map("expires_at")
+  createdAt  DateTime @default(now()) @map("created_at")
+  updatedAt  DateTime @updatedAt @map("updated_at")
+
+  @@index([identifier])
+  @@map("verifications")
+}
+
+/// ApiToken - Bearer tokens for non-web clients (mobile apps, API integrations)
+model ApiToken {
+  id          String    @id @default(dbgenerated("('apitok_'::text || (uuidv7())::text)")) @db.Text
+  userId      String    @map("user_id")
+  
+  // Token identification
+  name        String    // "iPhone", "Android App", "API Integration"
+  token       String    @unique // Hashed token
+  tokenPrefix String    @map("token_prefix") // First 8 chars for identification
+  
+  // Client info
+  clientType  String    @default("api") @map("client_type") // "mobile", "api", "cli"
+  deviceInfo  String?   @map("device_info") // "iPhone 15 Pro", "Android 14"
+  
+  // Permissions
+  scopes      String[]  @default([]) // ["read:profile", "write:data"]
+  
+  // Lifecycle
+  expiresAt   DateTime? @map("expires_at")
+  lastUsedAt  DateTime? @map("last_used_at")
+  lastUsedIp  String?   @map("last_used_ip")
+  revokedAt   DateTime? @map("revoked_at")
+  
+  createdAt   DateTime  @default(now()) @map("created_at")
+
+  user          User           @relation(fields: [userId], references: [id], onDelete: Cascade)
+  refreshTokens RefreshToken[]
+
+  @@index([userId])
+  @@index([token])
+  @@index([tokenPrefix])
+  @@map("api_tokens")
+}
+
+/// RefreshToken - Long-lived tokens for mobile session refresh
+model RefreshToken {
+  id          String    @id @default(dbgenerated("('reftok_'::text || (uuidv7())::text)")) @db.Text
+  userId      String    @map("user_id")
+  apiTokenId  String    @map("api_token_id")
+  
+  token       String    @unique // Hashed
+  
+  // Lifecycle
+  expiresAt   DateTime  @map("expires_at")
+  usedAt      DateTime? @map("used_at")      // Last time used to get new access token
+  revokedAt   DateTime? @map("revoked_at")
+  
+  createdAt   DateTime  @default(now()) @map("created_at")
+
+  user     User     @relation(fields: [userId], references: [id], onDelete: Cascade)
+  apiToken ApiToken @relation(fields: [apiTokenId], references: [id], onDelete: Cascade)
+
+  @@index([userId])
+  @@index([apiTokenId])
+  @@index([token])
+  @@map("refresh_tokens")
+}
+
+/// OAuthClient - Registered OAuth applications (ChatGPT, Slack, etc.)
+model OAuthClient {
+  id           String   @id @default(dbgenerated("('oauthc_'::text || (uuidv7())::text)")) @db.Text
+  
+  // Client identification
+  name         String   // "ChatGPT Plugin", "Slack Bot"
+  description  String?
+  logoUrl      String?  @map("logo_url")
+  
+  // OAuth credentials
+  clientId     String   @unique @map("client_id")   // Public identifier
+  clientSecret String   @map("client_secret")       // Hashed secret
+  
+  // OAuth config
+  redirectUris String[] @map("redirect_uris")       // Allowed callback URLs
+  scopes       String[] @default([])                // Allowed scopes
+  
+  // Settings
+  enabled      Boolean  @default(true)
+  trusted      Boolean  @default(false)             // Skip consent screen
+  
+  createdAt    DateTime @default(now()) @map("created_at")
+  updatedAt    DateTime @updatedAt @map("updated_at")
+
+  authorizations OAuthAuthorization[]
+
+  @@map("oauth_clients")
+}
+
+/// OAuthAuthorization - User grants to OAuth clients
+model OAuthAuthorization {
+  id            String   @id @default(dbgenerated("('oautha_'::text || (uuidv7())::text)")) @db.Text
+  userId        String   @map("user_id")
+  clientId      String   @map("client_id")
+  
+  // Granted scopes (may be subset of client's allowed scopes)
+  scopes        String[]
+  
+  // Tokens
+  accessToken   String   @unique @map("access_token")   // Hashed
+  refreshToken  String?  @unique @map("refresh_token")  // Hashed
+  
+  // Lifecycle
+  expiresAt     DateTime @map("expires_at")
+  revokedAt     DateTime? @map("revoked_at")
+  
+  createdAt     DateTime @default(now()) @map("created_at")
+  updatedAt     DateTime @updatedAt @map("updated_at")
+
+  user   User        @relation(fields: [userId], references: [id], onDelete: Cascade)
+  client OAuthClient @relation(fields: [clientId], references: [id], onDelete: Cascade)
+
+  @@unique([userId, clientId])
+  @@index([userId])
+  @@index([clientId])
+  @@index([accessToken])
+  @@map("oauth_authorizations")
+}
+
+/// PushToken - Device tokens for push notifications
+model PushToken {
+  id          String   @id @default(dbgenerated("('pushtok_'::text || (uuidv7())::text)")) @db.Text
+  userId      String   @map("user_id")
+  
+  // Token details
+  token       String   @unique              // FCM or APNs token
+  platform    String                        // "ios", "android", "web"
+  
+  // Device info
+  deviceId    String?  @map("device_id")    // Unique device identifier
+  deviceName  String?  @map("device_name")  // "iPhone 15 Pro"
+  appVersion  String?  @map("app_version")  // "1.2.3"
+  
+  // Status
+  enabled     Boolean  @default(true)
+  failedAt    DateTime? @map("failed_at")   // Last delivery failure
+  failCount   Int      @default(0) @map("fail_count")
+  
+  createdAt   DateTime @default(now()) @map("created_at")
+  updatedAt   DateTime @updatedAt @map("updated_at")
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@index([userId])
+  @@index([platform])
+  @@map("push_tokens")
+}
+
+/// UserData - Flexible key-value storage for customer extensions
+/// Use this for: preferences, saved items, custom fields, feature flags
+model UserData {
+  id        String   @id @default(dbgenerated("('userd_'::text || (uuidv7())::text)")) @db.Text
+  userId    String   @map("user_id")
+  
+  // Key-value storage
+  key       String   // "preferences", "saved_products", "notification_settings"
+  value     Json     // Flexible JSON storage
+  
+  createdAt DateTime @default(now()) @map("created_at")
+  updatedAt DateTime @updatedAt @map("updated_at")
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([userId, key])
+  @@index([userId])
+  @@index([key])
+  @@map("user_data")
+}