SET NAMES utf8mb4;

CREATE TABLE IF NOT EXISTS user_verifications (
  user_id BIGINT UNSIGNED NOT NULL,
  verification_type VARCHAR(30) NOT NULL DEFAULT 'real_name',
  status VARCHAR(20) NOT NULL DEFAULT 'UNVERIFIED',
  real_name VARCHAR(50) NOT NULL DEFAULT '',
  document_mask VARCHAR(80) NOT NULL DEFAULT '',
  remark VARCHAR(500) NOT NULL DEFAULT '',
  reviewer_admin_id BIGINT UNSIGNED NULL,
  submitted_at DATETIME(3) NULL,
  reviewed_at DATETIME(3) NULL,
  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
  PRIMARY KEY (user_id),
  KEY idx_verification_status_updated (status, updated_at)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

CREATE TABLE IF NOT EXISTS user_sanctions (
  id BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
  user_id BIGINT UNSIGNED NOT NULL,
  sanction_type VARCHAR(30) NOT NULL,
  reason VARCHAR(500) NOT NULL,
  starts_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
  expires_at DATETIME(3) NULL,
  status VARCHAR(20) NOT NULL DEFAULT 'ACTIVE',
  operator_admin_id BIGINT UNSIGNED NOT NULL,
  revoked_by BIGINT UNSIGNED NULL,
  revoked_at DATETIME(3) NULL,
  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
  PRIMARY KEY (id),
  KEY idx_sanction_user_status_expire (user_id, status, expires_at),
  KEY idx_sanction_created (created_at)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

CREATE TABLE IF NOT EXISTS user_security_controls (
  user_id BIGINT UNSIGNED NOT NULL,
  token_version INT UNSIGNED NOT NULL DEFAULT 0,
  force_logout_at DATETIME(3) NULL,
  password_reset_at DATETIME(3) NULL,
  last_operator_admin_id BIGINT UNSIGNED NULL,
  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
  PRIMARY KEY (user_id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

SET @token_version_exists=(SELECT COUNT(*) FROM information_schema.COLUMNS WHERE TABLE_SCHEMA=DATABASE() AND TABLE_NAME='user_security_controls' AND COLUMN_NAME='token_version');
SET @token_version_sql=IF(@token_version_exists=0,'ALTER TABLE user_security_controls ADD COLUMN token_version INT UNSIGNED NOT NULL DEFAULT 0 AFTER user_id','SELECT 1');
PREPARE token_version_stmt FROM @token_version_sql;
EXECUTE token_version_stmt;
DEALLOCATE PREPARE token_version_stmt;

INSERT INTO user_verifications (user_id, status)
SELECT u.id, 'UNVERIFIED' FROM users u
LEFT JOIN user_verifications v ON v.user_id=u.id
WHERE v.user_id IS NULL;

INSERT INTO subscriptions (user_id, plan_id, source, status, started_at, expires_at)
SELECT p.user_id, mp.id, 'legacy_backfill', 1, NOW(3), DATE_ADD(NOW(3), INTERVAL mp.duration_days DAY)
FROM user_profiles p
JOIN membership_plans mp ON mp.level=p.vip_level
  AND mp.duration_days=(SELECT MAX(mp2.duration_days) FROM membership_plans mp2 WHERE mp2.level=p.vip_level)
WHERE p.is_vip=1 AND p.vip_level>0
  AND NOT EXISTS (SELECT 1 FROM subscriptions s WHERE s.user_id=p.user_id AND s.status=1 AND s.expires_at>NOW(3));