<?php
/**
 * PasskeysSchema - Database schema for the Passkeys module.
 *
 * Owns three tables:
 *   ultraguard_passkeys           - stored FIDO2 credentials per user
 *   ultraguard_passkey_challenges - short-lived WebAuthn challenge nonces
 *   ultraguard_recovery_codes     - bcrypt-hashed single-use backup codes
 *
 * @package UltraguardPro\modules\authenticator\schema
 */

namespace UltraguardPro\modules\authenticator\schema;

use UltraguardPro\modules\core\AbstractModuleSchema;

if ( ! defined( 'ABSPATH' ) ) { exit; }

class PasskeysSchema extends AbstractModuleSchema {

    public function get_module_id(): string { return 'passkeys'; }

    public function get_table_map(): array {
        return [
            'passkeys'           => \UltraguardPro\modules\authenticator\db\PasskeysTable::class,
            'passkey_challenges' => \UltraguardPro\modules\authenticator\db\PasskeyChallengesTable::class,
            'recovery_codes'     => \UltraguardPro\modules\authenticator\db\RecoveryCodesTable::class,
        ];
    }

    public function get_schemas(): array {
        $cs = $this->charset_collate();

        return [

            // ---- Stored FIDO2 credentials ----
            $this->table( 'ultraguard_passkeys' ) =>
            "CREATE TABLE {$this->table('ultraguard_passkeys')} (
              id            BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
              user_id       BIGINT UNSIGNED NOT NULL,
              credential_id VARCHAR(500)    NOT NULL,
              public_key    TEXT            NOT NULL,
              sign_count    INT UNSIGNED    NOT NULL DEFAULT 0,
              aaguid        VARCHAR(36)     DEFAULT NULL,
              device_name   VARCHAR(100)    NOT NULL DEFAULT '',
              last_used     DATETIME        DEFAULT NULL,
              created_at    DATETIME        NOT NULL DEFAULT CURRENT_TIMESTAMP,
              PRIMARY KEY (id),
              UNIQUE KEY idx_credential_id (credential_id(100)),
              KEY idx_user_id (user_id),
              KEY idx_created_at (created_at)
            ) {$cs};",

            // ---- Short-lived challenge nonces (expire after 5 minutes) ----
            $this->table( 'ultraguard_passkey_challenges' ) =>
            "CREATE TABLE {$this->table('ultraguard_passkey_challenges')} (
              id         BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
              user_id    BIGINT UNSIGNED NOT NULL,
              challenge  VARCHAR(500)    NOT NULL,
              type       ENUM('registration','authentication') NOT NULL,
              expires_at DATETIME        NOT NULL,
              created_at DATETIME        NOT NULL DEFAULT CURRENT_TIMESTAMP,
              PRIMARY KEY (id),
              KEY idx_user_expires (user_id, expires_at),
              KEY idx_created_at (created_at)
            ) {$cs};",

            // ---- bcrypt-hashed single-use recovery codes ----
            $this->table( 'ultraguard_recovery_codes' ) =>
            "CREATE TABLE {$this->table('ultraguard_recovery_codes')} (
              id         BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
              user_id    BIGINT UNSIGNED NOT NULL,
              code_hash  VARCHAR(255)    NOT NULL,
              used_at    DATETIME        DEFAULT NULL,
              created_at DATETIME        NOT NULL DEFAULT CURRENT_TIMESTAMP,
              PRIMARY KEY (id),
              KEY idx_user_id (user_id),
              KEY idx_created_at (created_at)
            ) {$cs};",

        ];
    }
}
