schema.prisma

datasource db {
  provider = "mysql"
  url      = env("DATABASE_URL")
}
 
generator client {
  provider = "prisma-client-js"
}
 
model User {
  id                 String          @id @default(cuid())
  name               String?
  username           String?         @unique
  email              String?         @unique
  password           String?
  emailVerified      DateTime?
  image              String?
  onboardingComplete Boolean         @default(false)
  onboardingStep     Int             @default(0) // 0 = not started, 1-3 = in progress steps, 4 = completed
  organizationId     String?
  organization       Organization?   @relation(fields: [organizationId], references: [id])
  accounts           Account[]
  sessions           Session[]
  // Optional for WebAuthn support
  Authenticator      Authenticator[]
 
  createdAt DateTime @default(now())
  updatedAt DateTime @updatedAt

  @@index([organizationId])
}
 
model Account {
  id                       String  @id @default(cuid())
  userId                   String  @unique
  type                     String
  provider                 String
  providerAccountId        String
  refresh_token            String? @db.Text
  access_token             String? @db.Text
  expires_at               Int?
  token_type               String?
  scope                    String?
  id_token                 String? @db.Text
  session_state            String?
  refresh_token_expires_in Int?
  user                     User?   @relation(fields: [userId], references: [id])
 
  createdAt DateTime @default(now())
  updatedAt DateTime @updatedAt
 
  @@unique([provider, providerAccountId])
  @@index([userId])
}
 
model Session {
  id           String   @id @default(cuid())
  sessionToken String   @unique
  userId       String
  expires      DateTime
  user         User     @relation(fields: [userId], references: [id])
 
  createdAt DateTime @default(now())
  updatedAt DateTime @updatedAt
 
  @@index([userId])
}
 
model VerificationToken {
  identifier String
  token      String
  expires    DateTime
 
  @@unique([identifier, token])
}

model Organization {
  id                  String   @id @default(cuid())
  name                String
  logo                String?
  industry            String?
  size                String?
  description         String?  @db.Text
  website             String?
  officeLocations     String?  @db.Text
  communicationTools  String?  @db.Text // JSON array of tools
  targetDepartments   String?  @db.Text // JSON array of departments
  executiveInfo       String?  @db.Text // JSON array of executive info
  vendorsPartners     String?  @db.Text // JSON array of vendors/partners
  recentEvents        String?  @db.Text
  socialMedia         String?  @db.Text // JSON array of social media links
  companyAnniversary  String?
  employeePerks       String?  @db.Text // JSON array of perks
  users               User[]
  employees           Employee[]
  campaigns           Campaign[]
  
  createdAt           DateTime @default(now())
  updatedAt           DateTime @updatedAt
}
 
// Optional for WebAuthn support
model Authenticator {
  credentialID         String  @unique
  userId               String
  providerAccountId    String
  credentialPublicKey  String
  counter              Int
  credentialDeviceType String
  credentialBackedUp   Boolean
  transports           String?
 
  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
 
  @@id([userId, credentialID])
}

model Employee {
  id              String            @id @default(cuid())
  employeeId      String            // External employee ID from the organization
  firstName       String
  lastName        String
  email           String
  organizationId  String
  organization    Organization      @relation(fields: [organizationId], references: [id], onDelete: Cascade)
  metadata        EmployeeMetadata[]
  phishingPlans   PhishingPlan[]
  
  createdAt       DateTime          @default(now())
  updatedAt       DateTime          @updatedAt
  
  @@unique([organizationId, employeeId])
  @@unique([organizationId, email])
  @@index([organizationId])
}

model EmployeeMetadata {
  id              String    @id @default(cuid())
  employeeId      String
  employee        Employee  @relation(fields: [employeeId], references: [id], onDelete: Cascade)
  key             String    // The column name from the CSV
  value           String    @db.Text // The value for this employee
  
  createdAt       DateTime  @default(now())
  updatedAt       DateTime  @updatedAt
  
  @@unique([employeeId, key])
  @@index([employeeId])
}

model Campaign {
  id              String          @id @default(cuid())
  name            String
  description     String?         @db.Text
  status          String          // draft, active, completed, cancelled
  organizationId  String
  organization    Organization    @relation(fields: [organizationId], references: [id], onDelete: Cascade)
  startDate       DateTime?
  endDate         DateTime?
  phishingPlans   PhishingPlan[]
  phishingTemplates PhishingTemplate[]
  
  createdAt       DateTime        @default(now())
  updatedAt       DateTime        @updatedAt
  
  @@index([organizationId])
}

model PhishingTemplate {
  id              String          @id @default(cuid())
  campaignId      String
  campaign        Campaign        @relation(fields: [campaignId], references: [id], onDelete: Cascade)
  lureType        String          // bonus, password_reset, ceo_request, etc.
  subject         String
  content         String          @db.Text
  fromName        String?
  fromEmail       String?
  phishingPlans   PhishingPlan[]
  
  createdAt       DateTime        @default(now())
  updatedAt       DateTime        @updatedAt
  
  @@index([campaignId])
}

model PhishingPlan {
  id              String            @id @default(cuid())
  campaignId      String
  campaign        Campaign          @relation(fields: [campaignId], references: [id], onDelete: Cascade)
  employeeId      String
  employee        Employee          @relation(fields: [employeeId], references: [id], onDelete: Cascade)
  templateId      String?
  template        PhishingTemplate? @relation(fields: [templateId], references: [id])
  lureType        String            // bonus, password_reset, ceo_request, etc.
  timing          String?           // immediate, delay_3_days, etc.
  tone            String?           // urgent, casual, formal
  attackVector    String?           // link, attachment, reply
  status          String            // pending, scheduled, sent, clicked, reported
  scheduledFor    DateTime?
  sentAt          DateTime?
  clickedAt       DateTime?
  reportedAt      DateTime?
  customSubject   String?
  customContent   String?           @db.Text
  
  createdAt       DateTime          @default(now())
  updatedAt       DateTime          @updatedAt
  
  @@index([campaignId])
  @@index([employeeId])
  @@index([templateId])
}