import { pgTable, timestamp, uuid } from "drizzle-orm/pg-core";
import { createdAt } from "./_shared.js";
import { users } from "./users.js";

/**
 * GDPR-retention pseudonyms (spec §56, docs/29).
 *
 * Financial/audit records must be retained for legal/tax/dispute purposes
 * (typically 7 years), but the natural person must not be directly
 * identifiable in those tables after account deletion.
 *
 * This table holds a one-way-looking mapping from the original user id to
 * a random pseudonym. The mapping itself is subject to strict access
 * controls and is deleted when the retention period expires.
 *
 * NOTE: The exact legal mechanism (key escrow, retention policy, deletion
 * job) must be confirmed in docs/23 before go-live.
 */
export const gdprRetentionPseudonyms = pgTable("gdpr_retention_pseudonyms", {
  id: uuid("id").primaryKey().defaultRandom(),
  userId: uuid("user_id")
    .notNull()
    .references(() => users.id, { onDelete: "cascade" })
    .unique(),
  pseudonym: uuid("pseudonym").notNull().unique(),
  /** When the mapping (and the retained records) may be hard-deleted. */
  retentionUntil: timestamp("retention_until", { withTimezone: true }).notNull(),
  createdAt: createdAt(),
  deletedAt: timestamp("deleted_at", { withTimezone: true }),
});
