module.exports = (sequelize, DataTypes) => {
  const EstablishmentUser = sequelize.define(
    "establishment_users",
    {
      id: {
        type: DataTypes.INTEGER,
        autoIncrement: true,
        primaryKey: true,
      },

      establishment_id: {
        type: DataTypes.INTEGER,
        allowNull: false,
      },

      name: {
        type: DataTypes.STRING,
        allowNull: false,
      },

      email: {
        type: DataTypes.STRING,
        allowNull: false,
        unique: true,
      },

      password: {
        type: DataTypes.STRING,
        allowNull: false,
      },

      gender: {
        type: DataTypes.STRING,
        allowNull: true,
      },

      is_active: {
        type: DataTypes.BOOLEAN,
        defaultValue: true,
      },

      created_at: {
        type: DataTypes.DATE,
        defaultValue: DataTypes.NOW,
      },

      created_by: {
        type: DataTypes.INTEGER,
        allowNull: false,
      },

      updated_at: {
        type: DataTypes.DATE,
        allowNull: true,
      },

      updated_by: {
        type: DataTypes.INTEGER,
        allowNull: true,
      },

      last_login: {
        type: DataTypes.DATE,
        allowNull: true,
      },

      reset_otp: {
        type: DataTypes.STRING,
        allowNull: true,
      },

      reset_otp_expires_at: {
        type: DataTypes.DATE,
        allowNull: true,
      },
    },
    {
      // ============================================================
      // Model Options
      // ============================================================
      timestamps: false,
      tableName: "establishment_users",

      // 1. Hide sensitive fields by default
      defaultScope: {
        attributes: {
          exclude: ["password", "reset_otp", "reset_otp_expires_at"],
        },
      },

      // 2. Scope for login / sensitive queries
      scopes: {
        withSensitive: {
          attributes: {
            include: ["password", "reset_otp", "reset_otp_expires_at"],
          },
        },
      },
    }
  );

  // 3. Remove sensitive fields from all API responses
  EstablishmentUser.prototype.toJSON = function () {
    const values = { ...this.get() };
    delete values.password;
    delete values.reset_otp;
    delete values.reset_otp_expires_at;
    return values;
  };

  // Relationships
  EstablishmentUser.associate = (models) => {
    EstablishmentUser.belongsTo(models.Establishment, {
      foreignKey: "establishment_id",
      as: "establishments",
    });
  };

  return EstablishmentUser;
};