module.exports = (sequelize, DataTypes) => {
    const User = sequelize.define(
    "admin_users", 
    {
      id: {
        type: DataTypes.INTEGER,
        autoIncrement: true,
        primaryKey: true,
      },
      name: {
        type: DataTypes.STRING,
        allowNull: false,
      },
      email: {
        type: DataTypes.STRING,
        allowNull: false,
        unique: true,
      },
      password: {
        type: DataTypes.STRING,
        allowNull: false,
      },
      last_login: {
        type: DataTypes.DATE,
        allowNull: true,
      },
      reset_otp: {
        type: DataTypes.STRING,
        allowNull: true,
      },
      reset_otp_expires_at: {
        type: DataTypes.DATE,
        allowNull: true,
      },
      is_active: {
        type: DataTypes.BOOLEAN,
        defaultValue: true,
      },
    },
    {
    //  1. EXCLUDE sensitive fields from all queries
     defaultScope: {
        attributes: { exclude: ["password", "reset_otp", "reset_otp_expires_at"] },
      },

      // -------------------------------------------------------------
      // 2. Special scope for login or OTP flows
      //    Use: User.scope("withSensitive").findOne(...)
      // -------------------------------------------------------------
      scopes: {
        withSensitive: {
          attributes: {
            include: ["password", "reset_otp", "reset_otp_expires_at"],
          },
        },
      },
    }
  );
  
    return User;
  };