-- saf_event：安全事件主表。事件和审计记录不允许物理删除。
CREATE TABLE IF NOT EXISTS saf_event (
  identity uuid PRIMARY KEY,
  event_code varchar(32) NOT NULL UNIQUE,
  device_identity uuid,
  level integer NOT NULL CHECK (level BETWEEN 1 AND 3),
  title varchar(256) NOT NULL,
  created_at timestamptz NOT NULL,
  updated_at timestamptz NOT NULL,
  created_by_identity uuid,
  updated_by_identity uuid,
  status varchar(32) NOT NULL DEFAULT 'pending',
  version integer NOT NULL DEFAULT 1
);

CREATE INDEX IF NOT EXISTS idx_saf_event_status_level ON saf_event(status, level);
COMMENT ON TABLE saf_event IS '安全事件主表';
COMMENT ON COLUMN saf_event.identity IS '主键，应用生成的 UUID V7';
COMMENT ON COLUMN saf_event.event_code IS '安全事件全局唯一业务编码';
COMMENT ON COLUMN saf_event.device_identity IS '关联 dev_device 的 identity';
COMMENT ON COLUMN saf_event.level IS '风险等级：1 高风险、2 中风险、3 低风险';
COMMENT ON COLUMN saf_event.title IS '安全事件说明';
COMMENT ON COLUMN saf_event.created_at IS '记录创建时间，UTC';
COMMENT ON COLUMN saf_event.updated_at IS '记录更新时间，UTC';
COMMENT ON COLUMN saf_event.created_by_identity IS '创建人 identity';
COMMENT ON COLUMN saf_event.updated_by_identity IS '更新人 identity';
COMMENT ON COLUMN saf_event.status IS '状态：pending、processing、closed、overdue';
COMMENT ON COLUMN saf_event.version IS '乐观锁版本';