Coach login and registration creates a verified coach account without coupling CoachMe identity to any one provider.

export const users = pgTable("users", {
  id: uuid("id").primaryKey().defaultRandom(),
  primaryEmail: text("primary_email"),
  primaryPhone: text("primary_phone"),
  displayName: text("display_name").notNull(),
  status: userStatus("status").notNull().default("ACTIVE"),
  roles: text("roles").array().notNull().default(sql`ARRAY[]::text[]`),
  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
}, (table) => ({
  emailUnique: uniqueIndex("users_primary_email_lower_uq")
    .on(sql`lower(${table.primaryEmail})`)
    .where(sql`${table.primaryEmail} is not null`),
  phoneUnique: uniqueIndex("users_primary_phone_uq")
    .on(table.primaryPhone)
    .where(sql`${table.primaryPhone} is not null`),
}));

export const authIdentities = pgTable("auth_identities", {
  id: uuid("id").primaryKey().defaultRandom(),
  userId: uuid("user_id").notNull().references(() => users.id),
  provider: text("provider").notNull(),
  issuer: text("issuer").notNull(),
  providerSubject: text("provider_subject").notNull(),
  emailVerified: boolean("email_verified").notNull().default(false),
  phoneVerified: boolean("phone_verified").notNull().default(false),
  rawClaims: jsonb("raw_claims").$type<Record<string, unknown>>().notNull(),
  lastLoginAt: timestamp("last_login_at", { withTimezone: true }),
}, (table) => ({
  providerSubjectUnique: uniqueIndex("auth_identities_provider_subject_uq")
    .on(table.provider, table.issuer, table.providerSubject),
  userIdx: index("auth_identities_user_idx").on(table.userId),
}));

export class User extends AggregateRoot<UserId> {
  private constructor(private props: UserProps) {
    super(props.id);
  }

  static registerCoach(command: RegisterCoachCommand, identity: VerifiedProviderIdentity): User {
    if (!identity.emailVerified && !identity.phoneVerified) {
      throw new DomainError("COACH_IDENTITY_NOT_VERIFIED");
    }

    const user = new User({
      id: UserId.create(),
      displayName: command.displayName,
      primaryEmail: identity.email,
      primaryPhone: identity.phone,
      status: "ACTIVE",
      roles: ["COACH"],
      identities: [AuthIdentity.fromVerifiedProvider(identity)],
      terms: TermsAcceptance.accept(command.termsVersion, command.privacyVersion),
    });

    user.addEvent(new CoachRegistered({
      userId: user.id.value,
      provider: identity.provider,
      occurredAt: new Date(),
    }));

    return user;
  }
}

@Injectable()
export class RegisterCoachUseCase {
  constructor(
    private readonly identities: AuthIdentityRepository,
    private readonly users: UserRepository,
    private readonly workspaces: CoachWorkspaceRepository,
    private readonly tokenVerifier: OidcTokenVerifier,
    private readonly tx: TransactionRunner,
  ) {}

  async execute(input: RegisterCoachInput, token: AccessToken): Promise<CoachSessionDto> {
    const verifiedIdentity = await this.tokenVerifier.verify(token);

    return this.tx.run(async () => {
      const existing = await this.identities.findByProviderRef(verifiedIdentity.ref);
      if (existing) return this.users.getCoachSessionContext(existing.userId);

      const user = User.registerCoach(input, verifiedIdentity);
      const workspace = CoachWorkspace.createDefaultFor(user, input.workspaceName);

      await this.users.save(user);
      await this.workspaces.saveWithOwner(workspace, user.id);
      await this.users.saveEventsToOutbox(user);

      return this.users.getCoachSessionContext(user.id);
    });
  }
}

@Controller("/api/v1/auth")
export class CoachAuthController {
  constructor(
    private readonly registerCoach: RegisterCoachUseCase,
    private readonly sessionQuery: SessionContextQuery,
  ) {}

  @Post("coach-registration")
  @UseGuards(KeycloakBearerGuard)
  async register(@Body() body: RegisterCoachDto, @CurrentToken() token: AccessToken) {
    return this.registerCoach.execute(body, token);
  }

  @Get("me")
  @UseGuards(KeycloakBearerGuard)
  async me(@CurrentIdentity() identity: VerifiedProviderIdentity) {
    return this.sessionQuery.forProviderIdentity(identity.ref);
  }
}

export async function completeCoachRegistration(input: RegisterCoachForm) {
  const token = await authClient.getAccessToken();

  const response = await api.auth.completeCoachRegistration({
    headers: { Authorization: `Bearer ${token}` },
    body: {
      displayName: input.displayName.trim(),
      workspaceName: input.workspaceName.trim(),
      timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
      locale: input.locale,
      termsVersion: CURRENT_TERMS_VERSION,
      privacyVersion: CURRENT_PRIVACY_VERSION,
    },
  });

  sessionStore.set(response);
  redirect("/dashboard");
}