schema.prisma

// This is your Prisma schema file,
// learn more about it in the docs: https://pris.ly/d/prisma-schema

datasource db {
    provider = "postgresql"
    url      = env("DATABASE_URL")
}

generator client {
    provider        = "prisma-client-js"
    previewFeatures = ["nApi", "referentialActions"]
}

model User {
    id         String @id @default(cuid()) @map("_id")
    username   String @unique
    email      String @unique
    password   String // pbkdf2 on client-side -> encrypted with bcrypt with >=10 rounds on server-side
    publicKey  String // not encrypted
    privateKey String // encrypted with AES-256 (key is derived from password)

    icon Icon?

    devices  Device[]
    keycards Keycard[]
    @@map("users")
}

model Icon {
    id    String   @id @default(cuid()) @map("_id")
    type  IconType
    value String
    user  User     @relation(fields: [userId], references: [id])

    userId String @map("user_id")
    @@map("icons")
}

model EmailConfirmation {
    // information needed to verify email
    id     String @id @default(cuid()) @map("_id")
    secret String

    // information needed to create user
    email      String
    username   String
    password   String // encrypted on client side
    publicKey  String
    privateKey String // encrypted with the password of the user

    // information needed to create device
    deviceName String?
    deviceType DeviceType?
    createdAt  DateTime    @default(now())

    @@map("email_confirmations")
}

model Device {
    id         String      @id @default(cuid()) @map("_id")
    secret     String? // the secret of the refresh token
    name       String?
    type       DeviceType?
    loggedInAt DateTime    @default(now()) @map("logged_in_at")
    user       User        @relation(fields: [userId], references: [id])

    userId String
    @@map("devices")
}

model Safe {
    id          String  @id @default(cuid()) @map("_id")
    name        String
    description String?
    items       Item[]

    keycards Keycard[]
    @@map("safes")
}

model Item {
    id   String @id @default(cuid()) @map("_id")
    data String
    safe Safe   @relation(fields: [safeId], references: [id])

    safeId String @map("safe_id")
    @@map("items")
}

model Keycard {
    id     String   @id @default(cuid()) @map("_id")
    secret String // encrypted with RSA-2048 with user's publicRSAKey
    safe   Safe     @relation(fields: [safeId], references: [id])
    user   User     @relation(fields: [userId], references: [id])
    role   RoleType

    safeId String @map("safe_id")
    userId String @map("user_id")
    @@unique([safeId, userId])
    @@map("keycards")
}

enum IconType {
    EMOJI
    IMAGE
}

enum RoleType {
    OWNER
    WRITER
    READER
}

enum DeviceType {
    BROWSER
    MOBILE
    DESKTOP
    CLI
}