-- Tabelle für bekannte, verifizierte Geräte
CREATE TABLE IF NOT EXISTS public.known_devices (
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    user_id UUID NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
    device_hash TEXT NOT NULL,
    ip_address TEXT,
    user_agent TEXT,
    verified_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
    UNIQUE (user_id, device_hash)
);

ALTER TABLE public.known_devices ENABLE ROW LEVEL SECURITY;

DO $$ 
BEGIN
    IF NOT EXISTS (
        SELECT 1 FROM pg_policies WHERE tablename = 'known_devices' AND policyname = 'Users can manage own devices'
    ) THEN
        CREATE POLICY "Users can manage own devices" ON public.known_devices
            FOR ALL USING (auth.uid() = user_id);
    END IF;
END $$;

-- Tabelle für temporäre OTP-Verifizierungscodes (ohne RLS-Zutritt für Clients)
CREATE TABLE IF NOT EXISTS public.device_verification_codes (
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    user_id UUID NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
    code TEXT NOT NULL,
    device_hash TEXT NOT NULL,
    expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
);

ALTER TABLE public.device_verification_codes ENABLE ROW LEVEL SECURITY;
-- Keine Policies -> Nur serverseitiger Zugriff über Admin-Client