# WG Paid / VM121 — domain model and security V2

## Core entities

### User
Normalized unique email, verification and login metadata.

### Plan
Product defaults, including protocol quotas.

### AccessGrant
Source-independent right to service: invite/admin/migration/payment/referral.

### AccessGrantProtocolLimit
One row per grant and protocol.

### Invite
Hashed token, grant template, protocol quotas, validity and redemption limits.

### MagicLinkToken / AuthSession
Hashed one-time tokens and secure sessions.

### ConnectionProfile
One user-downloadable configuration:

- protocol_code;
- display_name;
- status;
- access_grant;
- current credential revision.

### PeerCredential
Protocol-specific material:

- public key;
- encrypted private key;
- encrypted PSK;
- tunnel IP;
- server/config parameter version;
- desired/runtime status;
- validity.

No selector field.

### ProtocolServerProfile
Non-secret reference to current server interface/config renderer parameters:

- protocol;
- node;
- interface;
- endpoint;
- pool;
- public key fingerprint;
- config parameter version.

Raw server private key remains outside DB/publication.

### ProvisioningJob
Idempotent protocol-aware enable/disable/reissue/reconcile job with retries.

### Order / Payment
Creates or extends AccessGrant.

### AuditEvent
Safe, immutable actor/action/result metadata.

## AmneziaWG parameters

Client configuration needs a versioned set of AWG parameters. They must be stored as a server profile/config renderer version, not duplicated freely in every business object.

Changing AWG parameters requires a compatibility and reissue policy.

## Security invariants

- raw invite/magic/session tokens never stored;
- private keys/PSK encrypted;
- no secret output in diagnostics;
- admin API authenticated and network-restricted;
- public login response does not reveal email existence;
- rate limiting and CSRF protection;
- DB migrations only through versioned migrations;
- encrypted backup plus protected master-key backup.