Model Users and Sessions

Authentication in Readly will be built later, but the data layer needs its ownership model first.

Task

Add User and Session models to prisma/schema.prisma.

Use the following fields as the foundation for custom session-based authentication:

model User {
  id        String   @id @default(cuid())
  email     String   @unique
  name      String?
  password  String
  createdAt DateTime @default(now())
  updatedAt DateTime @updatedAt

  sessions          Session[]
  books             Book[]
  bookmarks         Bookmark[]
  highlights        Highlight[]
  notes             Note[]
  readerPreferences ReaderPreference?
}

model Session {
  id        String   @id @default(cuid())
  tokenHash String   @unique
  userId    String
  expiresAt DateTime
  createdAt DateTime @default(now())

  user User @relation(fields: [userId], references: [id], onDelete: Cascade)

  @@index([userId])
  @@index([expiresAt])
}

The password field stores a hash, not a plaintext password. Password hashing is implemented in Module 3.

Why the Session Belongs to a User

The relationship gives every session an owner and lets session cleanup follow the user lifecycle.

The tokenHash is unique so a session lookup can identify one stored session without storing the raw session token.

Test

Run:

npx prisma format
npx prisma validate

Checkpoint

Prisma should validate User and Session, including their relationship, without errors.