-- 009_plugins_usb_file_audit.sql: USB File Audit plugin (U盘文件操作记录)

CREATE TABLE IF NOT EXISTS usb_file_operations (
    id              INTEGER PRIMARY KEY AUTOINCREMENT,
    device_uid      TEXT NOT NULL REFERENCES devices(device_uid) ON DELETE CASCADE,
    usb_serial      TEXT,
    drive_letter    TEXT,
    operation       TEXT NOT NULL CHECK(operation IN ('create', 'delete', 'rename', 'modify')),
    file_path       TEXT NOT NULL,
    file_size       INTEGER,
    timestamp       TEXT NOT NULL DEFAULT (datetime('now'))
);

CREATE INDEX IF NOT EXISTS idx_usb_file_ops_device ON usb_file_operations(device_uid, timestamp);
CREATE INDEX IF NOT EXISTS idx_usb_file_ops_time ON usb_file_operations(timestamp);
CREATE INDEX IF NOT EXISTS idx_usb_file_ops_usb ON usb_file_operations(usb_serial, timestamp);