Phase D

packages/database/prisma/schema.prisma

@@ -147,6 +147,11 @@ enum IntegrationOperationStatus {
   FAILED
 }
 
+enum SsoTicketKind {
+  SERVICE
+  ADMIN
+}
+
 model User {
   id                  String     @id @default(uuid())
   email               String     @unique
@@ -169,6 +174,7 @@ model User {
   totpCredential          TotpCredential?
   creditWallet            CreditWallet?
   whmcsClientLink         WhmcsClientLink?
+  ssoTickets              SsoTicket[]
 
   @@map("users")
 }
@@ -194,6 +200,8 @@ model UserSession {
   revokedAt DateTime? @db.Timestamptz(3)
   ipAddress String?
   userAgent String?
+  isImpersonation      Boolean @default(false)
+  impersonationMetadata Json?
   createdAt DateTime  @default(now()) @db.Timestamptz(3)
   updatedAt DateTime  @updatedAt @db.Timestamptz(3)
 
@@ -332,6 +340,7 @@ model GameServer {
   usageRecords     UsageRecord[]
   dnsRecords       ServerDnsRecord[]
   whmcsServiceLink WhmcsServiceLink?
+  ssoTickets       SsoTicket[]
 
   @@index([userId])
   @@index([nodeId])
@@ -714,6 +723,7 @@ model WhmcsInstallation {
   clientLinks  WhmcsClientLink[]
   serviceLinks WhmcsServiceLink[]
   operations   IntegrationOperation[]
+  ssoTickets   SsoTicket[]
 
   @@map("whmcs_installations")
 }
@@ -770,3 +780,30 @@ model IntegrationOperation {
   @@index([installationId, createdAt])
   @@map("integration_operations")
 }
+
+model SsoTicket {
+  id                String        @id @default(uuid())
+  installationId    String
+  tokenHash         String        @unique
+  kind              SsoTicketKind
+  userId            String
+  serverId          String?
+  externalServiceId String?
+  externalClientId  String?
+  externalUserId    String?
+  targetPath        String
+  issuer            String
+  audience          String
+  nonce             String        @unique
+  expiresAt         DateTime      @db.Timestamptz(3)
+  usedAt            DateTime?     @db.Timestamptz(3)
+  createdAt         DateTime      @default(now()) @db.Timestamptz(3)
+
+  installation WhmcsInstallation @relation(fields: [installationId], references: [id], onDelete: Cascade)
+  user         User              @relation(fields: [userId], references: [id], onDelete: Cascade)
+  server       GameServer?       @relation(fields: [serverId], references: [id], onDelete: SetNull)
+
+  @@index([expiresAt])
+  @@index([installationId, createdAt])
+  @@map("sso_tickets")
+}