erDiagram
    User ||--o{ UserSession : "possede"
    User ||--o{ OtpRecord : "possede"
    User ||--o{ PasswordHistory : "possede"
    User ||--o{ PushToken : "possede"
    User ||--o{ TwoFactorChallenge : "possede"
    User ||--o{ UserSecuritySettings : "possede (1:1)"
    User }o--o{ Role : "via UserRole"
    User ||--o{ UserClaim : "possede"
    User ||--o{ UserLogin : "possede"
    User ||--o{ UserToken : "possede"
    User ||--o{ UserGroup : "appartient a"
    Group ||--o{ UserGroup : "contient"
    Group ||--o{ GroupRole : "associe a"
    Role ||--o{ GroupRole : "associe a"
    Role ||--o{ RoleClaim : "possede"

    User {
        Guid Id PK
        string Email
        string UserName
        string FirstName
        string LastName
        string PassPortNumber
        bool IsActive
        string ImageUrl
        DateTime LastPasswordChangeDate
        DateTime CreatedAt
        DateTime LastLoginAt
        long Version
        bool EmailConfirmed
        bool TwoFactorEnabled
        string SecurityStamp
        string PhoneNumber
    }

    Role {
        Guid Id PK
        string Name
        string NormalizedName
        string Description
        long Version
    }

    UserRole {
        Guid UserId FK
        Guid RoleId FK
        long Version
    }

    UserSession {
        Guid Id PK
        Guid UserId FK
        string RefreshTokenHash
        string PreviousRefreshTokenHash
        Guid TokenFamilyId
        string IpAddress
        string UserAgent
        string DeviceId
        string DeviceType
        string Browser
        string OperatingSystem
        DateTime CreatedAt
        DateTime LastActivityAt
        DateTime ExpiresAt
        DateTime RevokedAt
        string RevocationReason
    }

    OtpRecord {
        Guid Id PK
        Guid UserId FK
        string CodeHash
        string TokenFingerprint
        string Purpose
        DateTime ExpiresAt
        int Attempts
        bool IsUsed
        DateTime CreatedAt
    }

    PasswordHistory {
        Guid Id PK
        Guid UserId FK
        string PasswordHash
        DateTime CreatedAt
    }

    PushToken {
        Guid Id PK
        Guid UserId FK
        string Token
        string Platform
        string DeviceId
        DateTime CreatedAt
        DateTime UpdatedAt
    }

    TwoFactorChallenge {
        Guid Id PK
        Guid UserId FK
        string TokenFingerprint
        string TokenHash
        DateTime ExpiresAt
        int Attempts
        bool IsConsumed
        DateTime CreatedAt
    }

    UserSecuritySettings {
        Guid Id PK
        Guid UserId FK
        bool LoginNotificationsEnabled
        bool SessionAlertEnabled
    }

    UserClaim {
        int Id PK
        Guid UserId FK
        string ClaimType
        string ClaimValue
        long Version
    }

    UserLogin {
        string LoginProvider PK
        string ProviderKey PK
        Guid UserId FK
        string ProviderEmail
        DateTime LinkedAt
        long Version
    }

    UserToken {
        Guid UserId PK
        string LoginProvider PK
        string Name PK
        string Value
        long Version
    }

    Group {
        Guid Id PK
        string Name UK
        string Description
        DateTime CreatedAt
    }

    GroupRole {
        Guid Id PK
        Guid GroupId FK
        Guid RoleId FK
    }

    UserGroup {
        Guid Id PK
        Guid UserId FK
        Guid GroupId FK
        DateTime JoinedAt
    }

    IdempotencyRecord {
        Guid Id PK
        string Key
        string RequestIdentity
        string RequestBodyHash
        int StatusCode
        string ResponseBody
        DateTime CreatedAt
        DateTime ExpiresAt
    }

erDiagram
    AuditLog {
        Guid Id PK
        DateTime OccurredAtUtc
        DateTime ReceivedAtUtc
        string ModuleName
        string ActionName
        string EventType
        string EntityType
        string EntityId
        Guid ActorUserId
        string ActorType
        string Result
        string Reason
        string Severity
        string TenantId
        string IpAddress
        string UserAgent
        string CorrelationId
        string RequestId
        string TraceId
        string SpanId
        text_array Tags
        jsonb MetadataJson
        string TokenFingerprintSha256
        string Source
        jsonb PayloadJson
        int Version
    }

erDiagram
    SentMessage {
        Guid Id PK
        string Channel
        string Recipient
        string TemplateName
        string Subject
        string Status
        string ErrorMessage
        int Attempts
        DateTime CreatedAt
        DateTime SentAt
        string CorrelationId
    }