/**
 * admin_refresh_tokens — PLANNING.md §6a, verbatim DDL.
 * Rotating refresh tokens with reuse detection: family_id is the rotation
 * lineage, replaced_by chains a rotated token to its successor (§8). Only the
 * sha256 of the token is stored.
 */
import type { Knex } from 'knex';

export async function up(knex: Knex): Promise<void> {
  await knex.schema.raw(`
    CREATE TABLE admin_refresh_tokens (
      id              CHAR(26)    NOT NULL PRIMARY KEY,
      admin_user_id   CHAR(26)    NOT NULL,
      family_id       CHAR(26)    NOT NULL,
      token_hash      CHAR(64)    NOT NULL,
      expires_at      DATETIME    NOT NULL,
      revoked_at      DATETIME    NULL,
      replaced_by     CHAR(26)    NULL,
      user_agent      VARCHAR(255) NULL,
      ip_hash         CHAR(64)    NULL,
      created_at      DATETIME    NOT NULL DEFAULT CURRENT_TIMESTAMP,
      UNIQUE KEY uq_refresh_token_hash (token_hash),
      KEY idx_refresh_user (admin_user_id),
      KEY idx_refresh_family (family_id),
      CONSTRAINT fk_refresh_user FOREIGN KEY (admin_user_id) REFERENCES admin_users(id) ON DELETE CASCADE
    ) ENGINE=InnoDB
  `);
}

export async function down(knex: Knex): Promise<void> {
  await knex.schema.raw('DROP TABLE IF EXISTS admin_refresh_tokens');
}