-- Customer PIN (docs/prd-point-coin.md F11, K8). A 6-digit PIN, separate from the
-- login password, approves everything that moves EnakPoint or EnakCoin on the
-- customer's request. Only its bcrypt hash is stored.
ALTER TABLE customers
    ADD COLUMN pin_hash               VARCHAR(255),
    ADD COLUMN pin_set_at             TIMESTAMP WITH TIME ZONE,
    -- Kept in the database, not a cache, so it cannot be dodged by waiting for a cache
    -- to expire or by hitting another server (Q17).
    ADD COLUMN pin_failed_attempts    INT NOT NULL DEFAULT 0,
    ADD COLUMN pin_locked_until       TIMESTAMP WITH TIME ZONE,
    -- Outgoing transfers are held for 24 hours after a PIN reset (Q16).
    ADD COLUMN transfer_blocked_until TIMESTAMP WITH TIME ZONE,
    ADD CONSTRAINT chk_customers_pin_failed_attempts CHECK (pin_failed_attempts >= 0);

-- Security log of PIN events. Not a balance movement, so not in wallet_transactions.
CREATE TABLE customer_security_events (
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    customer_id UUID NOT NULL REFERENCES customers(id) ON DELETE RESTRICT,
    -- PIN_SET, PIN_CHANGED, PIN_RESET, PIN_FAILED, PIN_LOCKED, PIN_REMOVED_BY_ADMIN
    event VARCHAR(30) NOT NULL,
    -- The admin, for PIN_REMOVED_BY_ADMIN.
    actor_user UUID,
    reason VARCHAR(255),
    ip_address VARCHAR(45),
    user_agent VARCHAR(255),
    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),

    CONSTRAINT chk_customer_security_events_admin CHECK (
        event <> 'PIN_REMOVED_BY_ADMIN' OR (actor_user IS NOT NULL AND reason IS NOT NULL))
);

CREATE INDEX idx_customer_security_events_customer_id_created_at ON customer_security_events(customer_id, created_at DESC);