import {
  Entity,
  PrimaryGeneratedColumn,
  Column,
  CreateDateColumn,
  Index,
} from 'typeorm';

/**
 * One row PER client login attempt (success or failure).
 *
 * Connection: scheme_dbs  (same DB as client_subscriptions / client_access_tokens).
 * This table is append-only: you INSERT on every login attempt and never UPDATE.
 *
 * It answers the questions you asked for:
 *   - which client logged in
 *   - from which device / browser / OS
 *   - from which IP
 *   - when
 *   - how (password / otp / access-token / refresh)
 *   - did it succeed, and if not, why
 */
@Entity('client_login_logs')
@Index(['company_id'])
@Index(['client_user_id'])
@Index(['client_email'])
@Index(['status'])
@Index(['created_at'])
export class ClientLoginLog {
  @PrimaryGeneratedColumn()
  id: number;

  /** The company the client belongs to (null if login failed before we knew it). */
  @Column({ type: 'int', nullable: true })
  company_id: number | null;

  /** client_users.user_id / whatever your client principal id is (null on failed unknown user). */
  @Column({ type: 'int', nullable: true })
  client_user_id: number | null;

  /** Email that was used to log in (kept even on failure, for audit + brute-force visibility). */
  @Column({ type: 'varchar', length: 255, nullable: true })
  client_email: string | null;

  @Column({ type: 'varchar', length: 30, nullable: true })
  client_phone: string | null;

  /** password | otp | access_token | refresh_token | sso */
  @Column({ type: 'varchar', length: 30, default: 'password' })
  login_method: string;

  /** success | failed */
  @Column({
    type: 'enum',
    enum: ['success', 'failed'],
    default: 'success',
  })
  status: 'success' | 'failed';

  /** e.g. 'invalid_password', 'expired_token', 'no_subscription', 'user_disabled' */
  @Column({ type: 'varchar', length: 255, nullable: true })
  failure_reason: string | null;

  // ── Device / network fingerprint ─────────────────────────────
  /** IPv4 or IPv6 (45 chars covers IPv6). */
  @Column({ type: 'varchar', length: 45, nullable: true })
  ip_address: string | null;

  /** Raw User-Agent string (can be long → TEXT). */
  @Column({ type: 'text', nullable: true })
  user_agent: string | null;

  /** mobile | tablet | desktop | bot | unknown */
  @Column({ type: 'varchar', length: 20, nullable: true })
  device_type: string | null;

  @Column({ type: 'varchar', length: 60, nullable: true })
  browser: string | null;

  @Column({ type: 'varchar', length: 30, nullable: true })
  browser_version: string | null;

  @Column({ type: 'varchar', length: 60, nullable: true })
  os: string | null;

  @Column({ type: 'varchar', length: 30, nullable: true })
  os_version: string | null;

  // ── Links back to your existing token tables (optional) ──────
  /** client_access_tokens.id, if the login used a magic/access token. */
  @Column({ type: 'int', nullable: true })
  token_id: number | null;

  /** The session/refresh identifier issued on success, if you want to correlate. */
  @Column({ type: 'varchar', length: 255, nullable: true })
  session_id: string | null;

  @CreateDateColumn()
  created_at: Date;
}