Phase1

packages/database/prisma/schema.prisma

@@ -40,18 +40,25 @@ enum JobStatus {
 }
 
 model User {
-  id        String     @id @default(uuid())
-  email     String     @unique
-  username  String     @unique
-  status    UserStatus @default(ACTIVE)
-  createdAt DateTime   @default(now()) @db.Timestamptz(3)
-  updatedAt DateTime   @updatedAt @db.Timestamptz(3)
+  id                  String     @id @default(uuid())
+  email               String     @unique
+  username            String     @unique
+  displayName         String?
+  status              UserStatus @default(ACTIVE)
+  emailVerifiedAt     DateTime?  @db.Timestamptz(3)
+  failedLoginAttempts Int        @default(0)
+  lockedUntil         DateTime?  @db.Timestamptz(3)
+  createdAt           DateTime   @default(now()) @db.Timestamptz(3)
+  updatedAt           DateTime   @updatedAt @db.Timestamptz(3)
 
-  credentials   UserCredential[]
-  sessions      UserSession[]
-  platformRoles UserPlatformRole[]
-  gameServers   GameServer[]
-  auditEvents   AuditEvent[]
+  credentials              UserCredential[]
+  sessions                 UserSession[]
+  platformRoles            UserPlatformRole[]
+  gameServers              GameServer[]
+  auditEvents              AuditEvent[]
+  emailVerificationTokens  EmailVerificationToken[]
+  passwordResetTokens      PasswordResetToken[]
+  totpCredential           TotpCredential?
 
   @@map("users")
 }
@@ -87,6 +94,63 @@ model UserSession {
   @@map("user_sessions")
 }
 
+model EmailVerificationToken {
+  id        String    @id @default(uuid())
+  userId    String
+  tokenHash String    @unique
+  expiresAt DateTime  @db.Timestamptz(3)
+  usedAt    DateTime? @db.Timestamptz(3)
+  createdAt DateTime  @default(now()) @db.Timestamptz(3)
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@index([userId])
+  @@index([expiresAt])
+  @@map("email_verification_tokens")
+}
+
+model PasswordResetToken {
+  id        String    @id @default(uuid())
+  userId    String
+  tokenHash String    @unique
+  expiresAt DateTime  @db.Timestamptz(3)
+  usedAt    DateTime? @db.Timestamptz(3)
+  createdAt DateTime  @default(now()) @db.Timestamptz(3)
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@index([userId])
+  @@index([expiresAt])
+  @@map("password_reset_tokens")
+}
+
+model TotpCredential {
+  id        String    @id @default(uuid())
+  userId    String    @unique
+  secret    String
+  enabledAt DateTime? @db.Timestamptz(3)
+  createdAt DateTime  @default(now()) @db.Timestamptz(3)
+  updatedAt DateTime  @updatedAt @db.Timestamptz(3)
+
+  user          User           @relation(fields: [userId], references: [id], onDelete: Cascade)
+  recoveryCodes RecoveryCode[]
+
+  @@map("totp_credentials")
+}
+
+model RecoveryCode {
+  id               String    @id @default(uuid())
+  totpCredentialId String
+  codeHash         String
+  usedAt           DateTime? @db.Timestamptz(3)
+  createdAt        DateTime  @default(now()) @db.Timestamptz(3)
+
+  totpCredential TotpCredential @relation(fields: [totpCredentialId], references: [id], onDelete: Cascade)
+
+  @@index([totpCredentialId])
+  @@map("recovery_codes")
+}
+
 model PlatformRole {
   id          String   @id @default(uuid())
   name        String   @unique