# Generated by Django 6.1.1 on 2026-11-01 17:50

import django.db.models.deletion
import uuid
from django.conf import settings
from django.db import migrations, models


def revoke_legacy_sessions(apps, schema_editor):
    # Old JWTs predate per-device session IDs and cannot be listed or revoked
    # individually. Require one fresh login when this release is installed.
    apps.get_model('users','User').objects.using(schema_editor.connection.alias).all().update(auth_version=uuid.uuid4())


class Migration(migrations.Migration):

    dependencies = [
        ('users', '0002_account_security'),
    ]

    operations = [
        migrations.RunPython(revoke_legacy_sessions,migrations.RunPython.noop),
        migrations.CreateModel(
            name='AccountSecurity',
            fields=[
                ('user', models.OneToOneField(on_delete=django.db.models.deletion.CASCADE, primary_key=True, related_name='security_settings', serialize=False, to=settings.AUTH_USER_MODEL)),
                ('totp_secret', models.TextField(blank=True, default='')),
                ('totp_enabled', models.BooleanField(default=False)),
                ('last_totp_counter', models.BigIntegerField(default=-1)),
                ('recovery_hashes', models.JSONField(default=list)),
                ('failed_attempts', models.PositiveSmallIntegerField(default=0)),
                ('locked_until', models.DateTimeField(null=True)),
            ],
        ),
        migrations.CreateModel(
            name='AuthChallenge',
            fields=[
                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
                ('auth_version', models.UUIDField(null=True)),
                ('purpose', models.CharField(max_length=30)),
                ('payload', models.JSONField(default=dict)),
                ('created_at', models.DateTimeField(auto_now_add=True)),
                ('expires_at', models.DateTimeField()),
                ('attempts', models.PositiveSmallIntegerField(default=0)),
                ('consumed_at', models.DateTimeField(null=True)),
                ('user', models.ForeignKey(null=True, on_delete=django.db.models.deletion.CASCADE, to=settings.AUTH_USER_MODEL)),
            ],
        ),
        migrations.CreateModel(
            name='PasskeyCredential',
            fields=[
                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
                ('credential_id', models.CharField(max_length=1400, unique=True)),
                ('public_key', models.BinaryField()),
                ('sign_count', models.PositiveBigIntegerField(default=0)),
                ('name', models.CharField(default='Passkey', max_length=80)),
                ('rp_id', models.CharField(max_length=255)),
                ('created_at', models.DateTimeField(auto_now_add=True)),
                ('last_used_at', models.DateTimeField(null=True)),
                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='passkeys', to=settings.AUTH_USER_MODEL)),
            ],
        ),
        migrations.CreateModel(
            name='AccountDeletionRequest',
            fields=[
                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
                ('status', models.CharField(choices=[('PENDING', 'Pending review'), ('CANCELLED', 'Cancelled'), ('COMPLETED', 'Completed')], default='PENDING', max_length=16)),
                ('reason', models.CharField(blank=True, max_length=500)),
                ('created_at', models.DateTimeField(auto_now_add=True)),
                ('eligible_after', models.DateTimeField()),
                ('resolved_at', models.DateTimeField(null=True)),
                ('user', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='deletion_requests', to=settings.AUTH_USER_MODEL)),
            ],
            options={
                'constraints': [models.UniqueConstraint(condition=models.Q(('status', 'PENDING')), fields=('user',), name='user_one_pending_deletion')],
            },
        ),
        migrations.CreateModel(
            name='AccountSession',
            fields=[
                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
                ('method', models.CharField(default='PASSWORD', max_length=20)),
                ('user_agent', models.CharField(blank=True, max_length=350)),
                ('ip_address', models.GenericIPAddressField(null=True)),
                ('created_at', models.DateTimeField(auto_now_add=True)),
                ('last_seen_at', models.DateTimeField(auto_now_add=True)),
                ('expires_at', models.DateTimeField()),
                ('revoked_at', models.DateTimeField(null=True)),
                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='device_sessions', to=settings.AUTH_USER_MODEL)),
            ],
            options={
                'indexes': [models.Index(fields=['user', 'revoked_at', 'expires_at'], name='user_session_active_idx')],
            },
        ),
        migrations.CreateModel(
            name='LoginIdentity',
            fields=[
                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
                ('provider', models.CharField(choices=[('GOOGLE', 'Google'), ('PHONE', 'Phone'), ('SOLANA', 'Solana')], max_length=16)),
                ('subject', models.CharField(max_length=255)),
                ('label', models.CharField(blank=True, max_length=120)),
                ('created_at', models.DateTimeField(auto_now_add=True)),
                ('last_used_at', models.DateTimeField(null=True)),
                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='login_identities', to=settings.AUTH_USER_MODEL)),
            ],
            options={
                'constraints': [models.UniqueConstraint(fields=('provider', 'subject'), name='user_identity_provider_subject'), models.UniqueConstraint(condition=models.Q(('provider', 'PHONE')), fields=('user', 'provider'), name='user_one_phone_identity')],
            },
        ),
    ]