entity: Credential
version: "1.0"
description: "Secure credential storage for user authentication"

fields:
  id:
    type: uuid
    primary: true
    generated: true
    description: "Unique credential identifier"
    
  username:
    type: string
    required: true
    unique: true
    max_length: 50
    foreign_key:
      entity: User
      field: username
      on_delete: cascade
    description: "Associated username"
    
  password_hash:
    type: string
    required: true
    sensitive: true
    description: "Hashed password (never returned in queries)"
    
  first_login:
    type: boolean
    required: true
    default: true
    description: "Flag indicating if password change is required"
    
  created_at:
    type: datetime
    generated: true
    immutable: true
    
  updated_at:
    type: datetime
    auto_update: true

indexes:
  - fields: [username]
    unique: true

acl:
  create:
    system: true
  read:
    system: true
  update:
    system: true
  delete:
    system: true

security:
  never_expose: [password_hash]
  audit_all_access: true
