schema.zmodel

datasource db {
    provider = 'postgresql'
    url = env('DATABASE_URL')
}

/*
 * User model
 */
model User {
  id String @id @default(cuid())
  email String @unique
  emailVerified DateTime?
  // @password indicates the field is a password and its
  // value should be hashed (with bcrypt) before storing
  // @omit indicates the field should not be returned on read
  password String @password @omit
  name String?
  list List[]
  todos Todo[]

  // everybody can signup
  @@allow('create', true)

  // can be read by other users
  @@allow('read', auth() != null)

  // can only be updated and deleted by self
  @@allow('update,delete', auth() == this)
  }

/*
 * Todo list model
 */
model List {
    id String @id @default(uuid())
    createdAt DateTime @default(now())
    updatedAt DateTime @updatedAt
    title String
    private Boolean @default(false)
    ownerId String
    owner User @relation(fields: [ownerId], references: [id], onDelete: Cascade)
    todos Todo[]

    // require login
    @@deny('all', auth() == null)
    // owner has full access
    @@allow('all', auth() == owner)

    // can be read by anyone if is public 
    @@allow('read', !private)
}

/*
 * Todo model
 */
model Todo {
    id String @id @default(uuid())
    createdAt DateTime @default(now())
    updatedAt DateTime @updatedAt
    owner User @relation(fields: [ownerId], references: [id], onDelete: Cascade)
    ownerId String
    list List @relation(fields: [listId], references: [id], onDelete: Cascade)
    listId String
    title String
    completedAt DateTime?

    // require login
    @@deny('all', auth() == null)

    // list owner has full access 
    @@allow('all', list.owner == auth())

    // can be read by anyone if is public 
    @@allow('read', !list.private)
}