-- Migration: 006 – Service tokens for external notification senders
-- Database: PostgreSQL
--
-- Service tokens allow external services (CI/CD, monitoring, admin scripts) to
-- POST /api/notify without a full user JWT.  Each token is identified by a
-- SHA-256 hash so the plaintext is never stored after creation.

CREATE TABLE IF NOT EXISTS service_tokens (
    id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    name        TEXT NOT NULL,
    token_hash  TEXT NOT NULL UNIQUE,
    created_by  UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
    scopes      TEXT[] NOT NULL DEFAULT '{"notify"}',
    is_active   BOOLEAN NOT NULL DEFAULT TRUE,
    last_used_at TIMESTAMPTZ,
    expires_at  TIMESTAMPTZ,
    created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

CREATE INDEX IF NOT EXISTS idx_service_tokens_hash   ON service_tokens(token_hash) WHERE is_active;
CREATE INDEX IF NOT EXISTS idx_service_tokens_creator ON service_tokens(created_by);