<?php
/**
 * LoginLimiterSchema — Registers all seven DB tables for the Login Limiter module.
 *
 * Tables:
 *   1. ultraguard_login_attempts         — per-attempt log (IP, username, status)
 *   2. ultraguard_login_limiter_lockouts — active and historical lockout records
 *   3. ultraguard_user_sessions          — tracked user sessions
 *   4. ultraguard_user_activity          — login/logout/profile-change audit trail
 *   5. ultraguard_two_factor_auth        — per-user 2FA config
 *   6. ultraguard_ll_blocked_ips         — module-owned IP block list (no firewall dep)
 *   7. ultraguard_ll_allowed_ips         — module-owned IP allow list
 *
 * @package UltraguardPro\modules\loginlimiter\schema
 * @since   6.5.0
 */

namespace UltraguardPro\modules\loginlimiter\schema;

use UltraguardPro\modules\core\AbstractModuleSchema;

if ( ! defined( 'ABSPATH' ) ) { exit; }

class LoginLimiterSchema extends AbstractModuleSchema {

    public function get_module_id(): string { return 'login_limiter'; }

    // ── Table map ──────────────────────────────────────────────────────────────

    public function get_table_map(): array {
        return [
            'login_attempts'         => \UltraguardPro\modules\loginlimiter\db\LoginAttemptsTable::class,
            'login_limiter_lockouts' => \UltraguardPro\modules\loginlimiter\db\LoginLimiterLockoutsTable::class,
            'user_sessions'          => \UltraguardPro\modules\loginlimiter\db\UserSessionsTable::class,
            'user_activity'          => \UltraguardPro\modules\loginlimiter\db\UserActivityTable::class,
            'two_factor_auth'        => \UltraguardPro\modules\loginlimiter\db\TwoFactorAuthTable::class,
            'll_blocked_ips'         => \UltraguardPro\modules\loginlimiter\db\LlBlockedIpsTable::class,
            'll_allowed_ips'         => \UltraguardPro\modules\loginlimiter\db\LlAllowedIpsTable::class,
        ];
    }

    // ── CREATE TABLE statements ────────────────────────────────────────────────

    public function get_schemas(): array {
        $cs = $this->charset_collate();

        return [

            // ── 1. Login attempts ──────────────────────────────────────────────
            $this->table( 'ultraguard_login_attempts' ) =>
            "CREATE TABLE {$this->table('ultraguard_login_attempts')} (
              id           bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
              ip_address   varchar(45)         NOT NULL DEFAULT '',
              username     varchar(60)         NOT NULL DEFAULT '',
              status       varchar(20)         NOT NULL DEFAULT 'failed',
              user_agent   text                         DEFAULT NULL,
              country_code varchar(5)                   DEFAULT NULL,
              created_at   datetime            NOT NULL DEFAULT CURRENT_TIMESTAMP,
              PRIMARY KEY (id),
              KEY idx_ip_address  (ip_address(20)),
              KEY idx_username    (username(30)),
              KEY idx_status      (status),
              KEY idx_created_at  (created_at)
            ) {$cs};",

            // ── 2. Lockouts ────────────────────────────────────────────────────
            $this->table( 'ultraguard_login_limiter_lockouts' ) =>
            "CREATE TABLE {$this->table('ultraguard_login_limiter_lockouts')} (
              id             bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
              ip_address     varchar(45)         NOT NULL DEFAULT '',
              username       varchar(60)                  DEFAULT NULL,
              lockout_type   varchar(20)         NOT NULL DEFAULT 'ip',
              attempts_count int(11) UNSIGNED    NOT NULL DEFAULT 0,
              locked_at      datetime            NOT NULL DEFAULT CURRENT_TIMESTAMP,
              unlock_at      datetime            NOT NULL,
              is_active      tinyint(1)          NOT NULL DEFAULT 1,
              released_by    bigint(20) UNSIGNED          DEFAULT NULL,
              created_at     datetime            NOT NULL DEFAULT CURRENT_TIMESTAMP,
              updated_at     datetime            NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
              PRIMARY KEY (id),
              KEY idx_ip_address (ip_address(20)),
              KEY idx_is_active  (is_active),
              KEY idx_unlock_at  (unlock_at),
              KEY idx_locked_at  (locked_at)
            ) {$cs};",

            // ── 3. User sessions ───────────────────────────────────────────────
            $this->table( 'ultraguard_user_sessions' ) =>
            "CREATE TABLE {$this->table('ultraguard_user_sessions')} (
              id            bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
              user_id       bigint(20) UNSIGNED NOT NULL,
              session_token varchar(64)         NOT NULL DEFAULT '',
              ip_address    varchar(45)         NOT NULL DEFAULT '',
              user_agent    text                         DEFAULT NULL,
              is_active     tinyint(1)          NOT NULL DEFAULT 1,
              last_active   datetime            NOT NULL DEFAULT CURRENT_TIMESTAMP,
              expires_at    datetime            NOT NULL,
              created_at    datetime            NOT NULL DEFAULT CURRENT_TIMESTAMP,
              PRIMARY KEY (id),
              UNIQUE KEY idx_session_token (session_token),
              KEY idx_user_id    (user_id),
              KEY idx_ip_address (ip_address(20)),
              KEY idx_is_active  (is_active),
              KEY idx_expires_at (expires_at)
            ) {$cs};",

            // ── 4. User activity ───────────────────────────────────────────────
            $this->table( 'ultraguard_user_activity' ) =>
            "CREATE TABLE {$this->table('ultraguard_user_activity')} (
              id            bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
              user_id       bigint(20) UNSIGNED NOT NULL,
              activity_type varchar(100)        NOT NULL DEFAULT '',
              description   text                         DEFAULT NULL,
              ip_address    varchar(45)                  DEFAULT NULL,
              user_agent    text                         DEFAULT NULL,
              object_type   varchar(50)                  DEFAULT NULL,
              object_id     bigint(20) UNSIGNED          DEFAULT NULL,
              created_at    datetime            NOT NULL DEFAULT CURRENT_TIMESTAMP,
              PRIMARY KEY (id),
              KEY idx_user_id       (user_id),
              KEY idx_activity_type (activity_type),
              KEY idx_created_at    (created_at)
            ) {$cs};",

            // ── 5. Two-factor auth ─────────────────────────────────────────────
            $this->table( 'ultraguard_two_factor_auth' ) =>
            "CREATE TABLE {$this->table('ultraguard_two_factor_auth')} (
              id           bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
              user_id      bigint(20) UNSIGNED NOT NULL,
              method       varchar(20)         NOT NULL DEFAULT 'totp',
              secret_key   varchar(255)        NOT NULL DEFAULT '',
              backup_codes longtext                     DEFAULT NULL,
              is_enabled   tinyint(1)          NOT NULL DEFAULT 0,
              last_used_at datetime                     DEFAULT NULL,
              created_at   datetime            NOT NULL DEFAULT CURRENT_TIMESTAMP,
              updated_at   datetime            NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
              PRIMARY KEY (id),
              UNIQUE KEY idx_user_id  (user_id),
              KEY idx_is_enabled      (is_enabled)
            ) {$cs};",

            // ── 6. Module-owned IP block list ──────────────────────────────────
            $this->table( 'ultraguard_ll_blocked_ips' ) =>
            "CREATE TABLE {$this->table('ultraguard_ll_blocked_ips')} (
              id           bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
              ip_address   varchar(45)         NOT NULL DEFAULT '',
              reason       varchar(200)        NOT NULL DEFAULT 'manual',
              block_type   varchar(20)         NOT NULL DEFAULT 'manual',
              threat_level varchar(20)         NOT NULL DEFAULT 'medium',
              blocked_by   bigint(20) UNSIGNED NOT NULL DEFAULT 0,
              expires_at   datetime                     DEFAULT NULL,
              is_active    tinyint(1)          NOT NULL DEFAULT 1,
              created_at   datetime            NOT NULL DEFAULT CURRENT_TIMESTAMP,
              updated_at   datetime            NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
              PRIMARY KEY (id),
              UNIQUE KEY idx_ip_address (ip_address),
              KEY idx_is_active   (is_active),
              KEY idx_expires_at  (expires_at),
              KEY idx_threat_level (threat_level)
            ) {$cs};",

            // ── 7. Module-owned IP allow list ──────────────────────────────────
            $this->table( 'ultraguard_ll_allowed_ips' ) =>
            "CREATE TABLE {$this->table('ultraguard_ll_allowed_ips')} (
              id         bigint(20) UNSIGNED NOT NULL AUTO_INCREMENT,
              ip_address varchar(45)         NOT NULL DEFAULT '',
              label      varchar(200)        NOT NULL DEFAULT '',
              added_by   bigint(20) UNSIGNED NOT NULL DEFAULT 0,
              created_at datetime            NOT NULL DEFAULT CURRENT_TIMESTAMP,
              updated_at datetime            NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
              PRIMARY KEY (id),
              UNIQUE KEY idx_ip_address (ip_address)
            ) {$cs};",
        ];
    }
}
