-- Login sessions for both auth modes. Only a SHA-256 hash of the bearer
-- token is stored; possession of the database never yields valid tokens.

CREATE TABLE auth_sessions (
    token_hash TEXT PRIMARY KEY,
    user_id    UUID NOT NULL REFERENCES users (id),
    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
    expires_at TIMESTAMPTZ NOT NULL
);
CREATE INDEX auth_sessions_user_idx ON auth_sessions (user_id);