public/database/src/generated/entities/mod.rs

@@ -3,4 +3,6 @@
 pub mod prelude;
 
 pub mod config;
+pub mod session;
 pub mod user;
+pub mod user_identity;

public/database/src/generated/entities/prelude.rs

@@ -1,4 +1,6 @@
 //! `SeaORM` Entity, @generated by sea-orm-codegen 2.0.0-rc.18
 
 pub use super::config::Entity as Config;
+pub use super::session::Entity as Session;
 pub use super::user::Entity as User;
+pub use super::user_identity::Entity as UserIdentity;

public/database/src/generated/entities/session.rs

@@ -0,0 +1,29 @@
+//! `SeaORM` Entity, @generated by sea-orm-codegen 2.0.0-rc.18
+
+use sea_orm::entity::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[sea_orm::model]
+#[derive(Clone, Debug, PartialEq, Eq, DeriveEntityModel, Serialize, Deserialize)]
+#[sea_orm(table_name = "session")]
+pub struct Model {
+    #[sea_orm(primary_key, auto_increment = false)]
+    pub id: Uuid,
+    pub user_id: Uuid,
+    #[sea_orm(unique)]
+    pub refresh_token_hash: Option<String>,
+    pub expires_at: DateTimeUtc,
+    pub revoked_at: Option<DateTimeUtc>,
+    pub created_at: DateTimeUtc,
+    pub updated_at: DateTimeUtc,
+    #[sea_orm(
+        belongs_to,
+        from = "user_id",
+        to = "id",
+        on_update = "Cascade",
+        on_delete = "Cascade"
+    )]
+    pub user: HasOne<super::user::Entity>,
+}
+
+impl ActiveModelBehavior for ActiveModel {}

public/database/src/generated/entities/user.rs

@@ -12,10 +12,15 @@ pub struct Model {
     #[sea_orm(unique)]
     pub name: String,
     pub is_admin: bool,
-    pub password_hash: String,
-    pub salt: String,
+    pub is_active: bool,
     pub created_at: DateTimeUtc,
     pub updated_at: DateTimeUtc,
+    pub last_login_at: Option<DateTimeUtc>,
+    pub deleted_at: Option<DateTimeUtc>,
+    #[sea_orm(has_many)]
+    pub sessions: HasMany<super::session::Entity>,
+    #[sea_orm(has_many)]
+    pub user_identities: HasMany<super::user_identity::Entity>,
 }
 
 impl ActiveModelBehavior for ActiveModel {}

public/database/src/generated/entities/user_identity.rs

@@ -0,0 +1,35 @@
+//! `SeaORM` Entity, @generated by sea-orm-codegen 2.0.0-rc.18
+
+use sea_orm::entity::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[sea_orm::model]
+#[derive(Clone, Debug, PartialEq, Eq, DeriveEntityModel, Serialize, Deserialize)]
+#[sea_orm(table_name = "user_identity")]
+pub struct Model {
+    #[sea_orm(primary_key, auto_increment = false)]
+    pub id: Uuid,
+    #[sea_orm(unique_key = "provider")]
+    pub user_id: Uuid,
+    #[sea_orm(unique_key = "provider")]
+    pub provider: String,
+    pub email: Option<String>,
+    pub password_hash: Option<String>,
+    pub is_revoked: bool,
+    #[sea_orm(column_type = "JsonBinary", nullable)]
+    pub metadata: Option<Json>,
+    pub password_changed_at: Option<DateTimeUtc>,
+    pub revoked_at: Option<DateTimeUtc>,
+    pub created_at: DateTimeUtc,
+    pub updated_at: DateTimeUtc,
+    #[sea_orm(
+        belongs_to,
+        from = "user_id",
+        to = "id",
+        on_update = "Cascade",
+        on_delete = "Cascade"
+    )]
+    pub user: HasOne<super::user::Entity>,
+}
+
+impl ActiveModelBehavior for ActiveModel {}

public/migration/src/lib.rs

@@ -10,8 +10,10 @@ pub struct Migrator;
 impl MigratorTrait for Migrator {
     fn migrations() -> Vec<Box<dyn MigrationTrait>> {
         vec![
-            Box::new(m20251011_000001_create_user_table::Migration),
-            Box::new(m20251011_000002_create_config_table::Migration),
+            Box::new(m20251011_000001_create_config_table::Migration),
+            Box::new(m20251011_000002_create_user_table::Migration),
+            Box::new(m20251011_000003_create_user_identity_table::Migration),
+            Box::new(m20251011_000004_create_session_table::Migration),
         ]
     }
 }

public/migration/src/migrations.rs

@@ -1,2 +1,4 @@
-pub mod m20251011_000001_create_user_table;
-pub mod m20251011_000002_create_config_table;
+pub mod m20251011_000001_create_config_table;
+pub mod m20251011_000002_create_user_table;
+pub mod m20251011_000003_create_user_identity_table;
+pub mod m20251011_000004_create_session_table;

public/migration/src/migrations/m20251011_000002_create_user_table.rs

@@ -3,16 +3,19 @@ use sea_orm_migration::{prelude::*, schema::*};
 #[derive(DeriveMigrationName)]
 pub struct Migration;
 
+#[forbid(dead_code)]
 #[derive(DeriveIden)]
-enum User {
+pub enum User {
     Table,
     Id,
     //
     Name,
     IsAdmin,
-    PasswordHash,
-    Salt,
+    IsActive,
     //
+    LastLoginAt,
+    //
+    DeletedAt,
     CreatedAt,
     UpdatedAt,
 }
@@ -33,8 +36,12 @@ impl MigrationTrait for Migration {
                             .default(false)
                             .not_null(),
                     )
-                    .col(ColumnDef::new(User::PasswordHash).string().not_null())
-                    .col(ColumnDef::new(User::Salt).string().not_null())
+                    .col(
+                        ColumnDef::new(User::IsActive)
+                            .boolean()
+                            .default(true)
+                            .not_null(),
+                    )
                     .col(
                         ColumnDef::new(User::CreatedAt)
                             .timestamp()
@@ -47,6 +54,8 @@ impl MigrationTrait for Migration {
                             .default(SimpleExpr::Keyword(Keyword::CurrentTimestamp))
                             .not_null(),
                     )
+                    .col(ColumnDef::new(User::LastLoginAt).timestamp().null())
+                    .col(ColumnDef::new(User::DeletedAt).timestamp().null())
                     .to_owned(),
             )
             .await

public/migration/src/migrations/m20251011_000003_create_user_identity_table.rs

@@ -0,0 +1,102 @@
+use sea_orm_migration::{prelude::*, schema::*};
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[forbid(dead_code)]
+#[derive(DeriveIden)]
+pub enum UserIdentity {
+    Table,
+    Id,
+    UserId,
+    Provider, // e.g. "password". Extensible for plugins like OAuth in the future
+    //
+    Email,        // optional
+    PasswordHash, // optional for non-password providers
+    IsRevoked,    // default false
+    //
+    Metadata, // for custom provider metadata
+    //
+    PasswordChangedAt,
+    RevokedAt,
+    //
+    CreatedAt,
+    UpdatedAt,
+}
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        let _ = manager
+            .create_table(
+                Table::create()
+                    .table(UserIdentity::Table)
+                    .if_not_exists()
+                    .col(pk_uuid(UserIdentity::Id))
+                    //
+                    .col(ColumnDef::new(UserIdentity::UserId).uuid().not_null())
+                    .foreign_key(
+                        ForeignKey::create()
+                            .name("fk-user-identity-user-id")
+                            .from(UserIdentity::Table, UserIdentity::UserId)
+                            .to(
+                                super::m20251011_000002_create_user_table::User::Table,
+                                super::m20251011_000002_create_user_table::User::Id,
+                            )
+                            .on_delete(ForeignKeyAction::Cascade)
+                            .on_update(ForeignKeyAction::Cascade),
+                    )
+                    .col(ColumnDef::new(UserIdentity::Provider).string().not_null())
+                    //
+                    .col(ColumnDef::new(UserIdentity::Email).string().null())
+                    .col(ColumnDef::new(UserIdentity::PasswordHash).string().null())
+                    .col(
+                        ColumnDef::new(UserIdentity::IsRevoked)
+                            .boolean()
+                            .default(false)
+                            .not_null(),
+                    )
+                    .col(ColumnDef::new(UserIdentity::Metadata).json_binary().null())
+                    //
+                    .col(
+                        ColumnDef::new(UserIdentity::PasswordChangedAt)
+                            .timestamp()
+                            .null(),
+                    )
+                    .col(ColumnDef::new(UserIdentity::RevokedAt).timestamp().null())
+                    //
+                    .col(
+                        ColumnDef::new(UserIdentity::CreatedAt)
+                            .timestamp()
+                            .default(SimpleExpr::Keyword(Keyword::CurrentTimestamp))
+                            .not_null(),
+                    )
+                    .col(
+                        ColumnDef::new(UserIdentity::UpdatedAt)
+                            .timestamp()
+                            .default(SimpleExpr::Keyword(Keyword::CurrentTimestamp))
+                            .not_null(),
+                    )
+                    .to_owned(),
+            )
+            .await;
+
+        manager
+            .create_index(
+                Index::create()
+                    .name("idx-user-identity-user-id-provider")
+                    .table(UserIdentity::Table)
+                    .col(UserIdentity::UserId)
+                    .col(UserIdentity::Provider)
+                    .unique()
+                    .to_owned(),
+            )
+            .await
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .drop_table(Table::drop().table(UserIdentity::Table).to_owned())
+            .await
+    }
+}

public/migration/src/migrations/m20251011_000004_create_session_table.rs

@@ -0,0 +1,86 @@
+use sea_orm_migration::{prelude::*, schema::*};
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[forbid(dead_code)]
+#[derive(DeriveIden)]
+pub enum Session {
+    Table,
+    Id,
+    UserId,
+    //
+    RefreshTokenHash,
+    //
+    ExpiresAt,
+    RevokedAt,
+    //
+    CreatedAt,
+    UpdatedAt,
+}
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        let _ = manager
+            .create_table(
+                Table::create()
+                    .table(Session::Table)
+                    .if_not_exists()
+                    .col(pk_uuid(Session::Id))
+                    //
+                    .col(ColumnDef::new(Session::UserId).uuid().not_null())
+                    .foreign_key(
+                        ForeignKey::create()
+                            .name("fk-session-user-id")
+                            .from(Session::Table, Session::UserId)
+                            .to(
+                                super::m20251011_000002_create_user_table::User::Table,
+                                super::m20251011_000002_create_user_table::User::Id,
+                            )
+                            .on_delete(ForeignKeyAction::Cascade)
+                            .on_update(ForeignKeyAction::Cascade),
+                    )
+                    .col(
+                        ColumnDef::new(Session::RefreshTokenHash)
+                            .string()
+                            .null()
+                            .unique_key(),
+                    )
+                    .col(ColumnDef::new(Session::ExpiresAt).timestamp().not_null())
+                    .col(ColumnDef::new(Session::RevokedAt).timestamp().null())
+                    //
+                    .col(
+                        ColumnDef::new(Session::CreatedAt)
+                            .timestamp()
+                            .default(SimpleExpr::Keyword(Keyword::CurrentTimestamp))
+                            .not_null(),
+                    )
+                    .col(
+                        ColumnDef::new(Session::UpdatedAt)
+                            .timestamp()
+                            .default(SimpleExpr::Keyword(Keyword::CurrentTimestamp))
+                            .not_null(),
+                    )
+                    .to_owned(),
+            )
+            .await;
+
+        manager
+            .create_index(
+                Index::create()
+                    .name("idx-session-user-id-token")
+                    .table(Session::Table)
+                    .col(Session::UserId)
+                    .col(Session::RefreshTokenHash)
+                    .to_owned(),
+            )
+            .await
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .drop_table(Table::drop().table(Session::Table).to_owned())
+            .await
+    }
+}