-- name: CreateOwner :one
INSERT INTO users (username, username_key, display_name, password_hash)
VALUES (
    sqlc.arg(username),
    sqlc.arg(username_key),
    sqlc.arg(display_name),
    sqlc.arg(password_hash)
)
RETURNING id::TEXT AS id;

-- name: CreateOwnerRootNode :one
INSERT INTO nodes (
    owner_id,
    parent_id,
    name,
    name_key,
    node_type,
    size_bytes,
    node_revision,
    content_revision,
    content_modified_at,
    metadata_updated_at
)
VALUES (
    sqlc.arg(owner_id)::UUID,
    NULL,
    'Drive',
    'drive',
    'directory',
    0,
    1,
    0,
    sqlc.arg(created_at),
    sqlc.arg(created_at)
)
RETURNING id::TEXT AS id;

-- name: SetOwnerRootNode :exec
UPDATE users
SET root_node_id = sqlc.arg(root_node_id)::UUID,
    updated_at = sqlc.arg(updated_at)
WHERE id = sqlc.arg(owner_id)::UUID;

-- name: CreateRecoveryCode :exec
INSERT INTO recovery_codes (user_id, code_hash)
VALUES (sqlc.arg(owner_id)::UUID, sqlc.arg(code_hash));

-- name: CreateBrowserSession :one
INSERT INTO sessions (
    owner_id,
    token_hash,
    csrf_token_hash,
    remote_address,
    user_agent,
    authenticated_at,
    last_seen_at,
    expires_at
)
VALUES (
    sqlc.arg(owner_id)::UUID,
    sqlc.arg(token_hash),
    sqlc.arg(csrf_token_hash),
    NULLIF(sqlc.arg(remote_address), '')::INET,
    NULLIF(sqlc.arg(user_agent), ''),
    sqlc.arg(authenticated_at),
    sqlc.arg(authenticated_at),
    sqlc.arg(expires_at)
)
RETURNING id::TEXT AS id;

-- name: CreateInitialRootChange :exec
INSERT INTO changes (
    owner_id,
    event_type,
    node_id,
    node_revision,
    content_revision,
    resulting_state,
    mutation_origin,
    committed_at
)
VALUES (
    sqlc.arg(owner_id)::UUID,
    'node.created',
    sqlc.arg(root_node_id)::UUID,
    1,
    0,
    sqlc.arg(resulting_state)::JSONB,
    sqlc.arg(mutation_origin)::JSONB,
    sqlc.arg(committed_at)
);

-- name: CreateAuthenticationAuditEvent :exec
INSERT INTO audit_events (
    owner_id,
    actor,
    action,
    resource_type,
    resource_id,
    outcome,
    details,
    occurred_at
)
VALUES (
    sqlc.arg(owner_id)::UUID,
    sqlc.arg(actor)::JSONB,
    sqlc.arg(action),
    sqlc.arg(resource_type),
    sqlc.arg(resource_id)::UUID,
    sqlc.arg(outcome),
    sqlc.arg(details)::JSONB,
    sqlc.arg(occurred_at)
);

-- name: GetOwnerAuthenticationRecord :one
SELECT
    id::TEXT AS id,
    username,
    username_key,
    display_name,
    password_hash
FROM users
LIMIT 1;

-- name: GetActiveBrowserSession :one
SELECT
    sessions.id::TEXT AS session_id,
    sessions.owner_id::TEXT AS owner_id,
    users.username,
    users.display_name,
    sessions.csrf_token_hash,
    sessions.authenticated_at,
    sessions.last_seen_at,
    sessions.expires_at
FROM sessions
JOIN users ON users.id = sessions.owner_id
WHERE sessions.token_hash = sqlc.arg(token_hash)
  AND sessions.revoked_at IS NULL
  AND sessions.expires_at > sqlc.arg(now_at)
LIMIT 1;

-- name: TouchBrowserSession :exec
UPDATE sessions
SET last_seen_at = sqlc.arg(seen_at)
WHERE id = sqlc.arg(session_id)::UUID
  AND revoked_at IS NULL;

-- name: RevokeBrowserSession :execrows
UPDATE sessions
SET revoked_at = sqlc.arg(revoked_at)
WHERE id = sqlc.arg(session_id)::UUID
  AND revoked_at IS NULL;

-- name: GetAuthenticationInvariantCounts :one
SELECT
    (SELECT count(*) FROM users)::BIGINT AS owners,
    (SELECT count(*) FROM nodes WHERE parent_id IS NULL)::BIGINT AS roots,
    (SELECT count(*) FROM recovery_codes)::BIGINT AS recovery_codes,
    (SELECT count(*) FROM changes)::BIGINT AS changes,
    (SELECT count(*) FROM audit_events)::BIGINT AS audit_events,
    (SELECT count(*) FROM sessions)::BIGINT AS sessions,
    (SELECT count(*) FROM sessions WHERE revoked_at IS NULL)::BIGINT AS active_sessions;