SMS gone, approvals in

prisma/migrations/20261001070000_password_login/migration.sql

@@ -0,0 +1,34 @@
+-- CreateTable
+CREATE TABLE "LoginRequest" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "userId" TEXT NOT NULL,
+    "status" TEXT NOT NULL,
+    "secretHash" TEXT NOT NULL,
+    "expiresAt" DATETIME NOT NULL,
+    "decidedById" TEXT,
+    "decidedAt" DATETIME,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "LoginRequest_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User" ("id") ON DELETE CASCADE ON UPDATE CASCADE,
+    CONSTRAINT "LoginRequest_decidedById_fkey" FOREIGN KEY ("decidedById") REFERENCES "User" ("id") ON DELETE SET NULL ON UPDATE CASCADE
+);
+
+-- RedefineTables
+PRAGMA defer_foreign_keys=ON;
+PRAGMA foreign_keys=OFF;
+CREATE TABLE "new_User" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "name" TEXT NOT NULL,
+    "phone" TEXT NOT NULL,
+    "role" TEXT NOT NULL,
+    "dealerId" TEXT,
+    "passwordHash" TEXT,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" DATETIME NOT NULL,
+    CONSTRAINT "User_dealerId_fkey" FOREIGN KEY ("dealerId") REFERENCES "Dealer" ("id") ON DELETE SET NULL ON UPDATE CASCADE
+);
+INSERT INTO "new_User" ("createdAt", "dealerId", "id", "name", "phone", "role", "updatedAt") SELECT "createdAt", "dealerId", "id", "name", "phone", "role", "updatedAt" FROM "User";
+DROP TABLE "User";
+ALTER TABLE "new_User" RENAME TO "User";
+CREATE UNIQUE INDEX "User_phone_key" ON "User"("phone");
+PRAGMA foreign_keys=ON;
+PRAGMA defer_foreign_keys=OFF;

prisma/schema.prisma

@@ -14,16 +14,30 @@ model User {
   role         String
   dealerId     String?
   dealer       Dealer?   @relation("DealerStaff", fields: [dealerId], references: [id])
-  currentOtp   String?
-  otpExpiresAt DateTime?
+  passwordHash String?
   createdAt    DateTime  @default(now())
   updatedAt    DateTime  @updatedAt
 
-  assignments   DealerAssignment[] @relation("SalesRepAssignments")
-  stageLogs     StageLog[]
-  transfers     StockTransfer[]
-  events        Event[]
-  servicePoints ServicePoint[]
+  assignments     DealerAssignment[] @relation("SalesRepAssignments")
+  stageLogs       StageLog[]
+  transfers       StockTransfer[]
+  events          Event[]
+  servicePoints   ServicePoint[]
+  loginRequests   LoginRequest[]     @relation("DealerLoginRequests")
+  loginDecisions  LoginRequest[]     @relation("LoginDecisions")
+}
+
+model LoginRequest {
+  id          String    @id @default(cuid())
+  userId      String
+  user        User      @relation("DealerLoginRequests", fields: [userId], references: [id], onDelete: Cascade)
+  status      String
+  secretHash  String
+  expiresAt   DateTime
+  decidedById String?
+  decidedBy   User?     @relation("LoginDecisions", fields: [decidedById], references: [id])
+  decidedAt   DateTime?
+  createdAt   DateTime  @default(now())
 }
 
 model Dealer {

prisma/seed.js

@@ -3,24 +3,30 @@ require('dotenv').config({ path: path.join(__dirname, '..', '.env') });
 
 const prisma = require('../src/db');
 const { isValidPhone, normalizePhone } = require('../src/lib/phone');
+const { hashPassword } = require('../src/lib/passwords');
 
 async function main() {
   const name = String(process.env.SEED_ADMIN_NAME || 'Super Admin').trim();
   const phone = normalizePhone(process.env.SEED_ADMIN_PHONE);
+  const password = String(process.env.SEED_ADMIN_PASSWORD || '');
   if (!isValidPhone(phone)) {
     throw new Error('SEED_ADMIN_PHONE must be a Sri Lankan mobile number');
   }
+  if (password.length < 8) {
+    throw new Error('SEED_ADMIN_PASSWORD must be at least 8 characters');
+  }
 
+  const passwordHash = await hashPassword(password);
   const existingAdmin = await prisma.user.findFirst({ where: { role: 'superAdmin' } });
   const admin = existingAdmin
     ? await prisma.user.update({
         where: { id: existingAdmin.id },
-        data: { name, phone, role: 'superAdmin', dealerId: null },
+        data: { name, phone, role: 'superAdmin', dealerId: null, passwordHash },
       })
     : await prisma.user.upsert({
         where: { phone },
-        update: { name, role: 'superAdmin', dealerId: null },
-        create: { name, phone, role: 'superAdmin' },
+        update: { name, role: 'superAdmin', dealerId: null, passwordHash },
+        create: { name, phone, role: 'superAdmin', passwordHash },
       });
   console.log(`Seeded super admin ${admin.name} (${admin.phone})`);
 }