Sindbad~EG File Manager

-- Two-Factor Authentication System Database Schema

-- User 2FA Settings (for admin users table)
CREATE TABLE IF NOT EXISTS user_2fa_settings (
    id INT AUTO_INCREMENT PRIMARY KEY,
    user_id INT NOT NULL UNIQUE,
    is_enabled TINYINT(1) DEFAULT 0,
    primary_method ENUM('totp', 'email', 'sms') DEFAULT 'totp' COMMENT 'Preferred method',
    totp_enabled TINYINT(1) DEFAULT 0,
    email_enabled TINYINT(1) DEFAULT 0,
    sms_enabled TINYINT(1) DEFAULT 0,
    totp_secret VARCHAR(255) NULL,
    backup_codes TEXT NULL COMMENT 'JSON array of hashed backup codes',
    phone_number VARCHAR(20) NULL,
    email VARCHAR(255) NULL,
    last_used_at TIMESTAMP NULL,
    last_used_method VARCHAR(20) NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
    INDEX idx_user (user_id),
    INDEX idx_enabled (is_enabled)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

-- Member 2FA Settings (for member_accounts table)
CREATE TABLE IF NOT EXISTS member_2fa_settings (
    id INT AUTO_INCREMENT PRIMARY KEY,
    member_id INT NOT NULL UNIQUE,
    is_enabled TINYINT(1) DEFAULT 0,
    primary_method ENUM('totp', 'email', 'sms') DEFAULT 'totp' COMMENT 'Preferred method',
    totp_enabled TINYINT(1) DEFAULT 0,
    email_enabled TINYINT(1) DEFAULT 0,
    sms_enabled TINYINT(1) DEFAULT 0,
    totp_secret VARCHAR(255) NULL,
    backup_codes TEXT NULL COMMENT 'JSON array of hashed backup codes',
    phone_number VARCHAR(20) NULL,
    email VARCHAR(255) NULL,
    last_used_at TIMESTAMP NULL,
    last_used_method VARCHAR(20) NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    FOREIGN KEY (member_id) REFERENCES member_accounts(id) ON DELETE CASCADE,
    INDEX idx_member (member_id),
    INDEX idx_enabled (is_enabled)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

-- 2FA Verification Attempts Log
CREATE TABLE IF NOT EXISTS two_factor_attempts (
    id INT AUTO_INCREMENT PRIMARY KEY,
    user_type ENUM('admin', 'member') NOT NULL,
    user_id INT NOT NULL,
    method_used ENUM('totp', 'email', 'sms', 'backup') NOT NULL,
    success TINYINT(1) NOT NULL,
    ip_address VARCHAR(45) NULL,
    user_agent TEXT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    INDEX idx_user (user_type, user_id),
    INDEX idx_created (created_at)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

-- Temporary OTP codes for email/SMS verification
CREATE TABLE IF NOT EXISTS otp_codes (
    id INT AUTO_INCREMENT PRIMARY KEY,
    user_type ENUM('admin', 'member') NOT NULL,
    user_id INT NOT NULL,
    code VARCHAR(10) NOT NULL,
    method ENUM('email', 'sms') NOT NULL,
    expires_at TIMESTAMP NOT NULL,
    is_used TINYINT(1) DEFAULT 0,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    INDEX idx_user (user_type, user_id),
    INDEX idx_code (code),
    INDEX idx_expires (expires_at)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

-- System-wide 2FA settings table (key-value store)
CREATE TABLE IF NOT EXISTS system_settings (
    id INT AUTO_INCREMENT PRIMARY KEY,
    setting_key VARCHAR(100) UNIQUE NOT NULL,
    setting_value TEXT,
    setting_description TEXT,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    INDEX idx_setting_key (setting_key)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

-- Insert 2FA settings
INSERT INTO system_settings (setting_key, setting_value, setting_description) VALUES
('2fa_enforced_admin', '0', 'Require 2FA for all admin users'),
('2fa_enforced_member', '0', 'Require 2FA for all members'),
('2fa_grace_period_days', '7', 'Days to allow login without 2FA after enforcement'),
('2fa_backup_codes_count', '10', 'Number of backup codes to generate'),
('otp_expiry_minutes', '10', 'Minutes before email/SMS OTP expires'),
('otp_length', '6', 'Length of OTP codes')
ON DUPLICATE KEY UPDATE setting_value=VALUES(setting_value);