initial commit

internal/database/migrations/0002_client_login.sql

@@ -0,0 +1,54 @@
+-- +goose Up
+ALTER TABLE applications
+    ADD COLUMN client_id text NOT NULL UNIQUE DEFAULT ('glc_' || encode(gen_random_bytes(18), 'hex')),
+    ADD COLUMN client_secret_hash bytea,
+    ADD COLUMN redirect_uris text[] NOT NULL DEFAULT '{}';
+
+CREATE UNIQUE INDEX users_email_unique_idx ON users (lower(email));
+
+CREATE TABLE user_application_access (
+    application_id uuid NOT NULL REFERENCES applications(id) ON DELETE CASCADE,
+    user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    granted_by uuid REFERENCES users(id) ON DELETE SET NULL,
+    created_at timestamptz NOT NULL DEFAULT now(),
+    PRIMARY KEY (application_id, user_id)
+);
+
+INSERT INTO user_application_access(application_id, user_id, granted_by)
+SELECT a.id, m.user_id, m.user_id
+FROM applications a
+JOIN memberships m ON m.tenant_id = a.tenant_id
+ON CONFLICT DO NOTHING;
+
+CREATE TABLE client_authorization_codes (
+    code_hash bytea PRIMARY KEY,
+    application_id uuid NOT NULL REFERENCES applications(id) ON DELETE CASCADE,
+    user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    redirect_uri text NOT NULL,
+    expires_at timestamptz NOT NULL,
+    used_at timestamptz,
+    created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE client_user_sessions (
+    token_hash bytea PRIMARY KEY,
+    application_id uuid NOT NULL REFERENCES applications(id) ON DELETE CASCADE,
+    user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    expires_at timestamptz NOT NULL,
+    last_used_at timestamptz,
+    revoked_at timestamptz,
+    created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX client_user_sessions_user_idx ON client_user_sessions(user_id);
+CREATE INDEX client_authorization_codes_expiry_idx ON client_authorization_codes(expires_at);
+
+-- +goose Down
+DROP TABLE IF EXISTS client_user_sessions;
+DROP TABLE IF EXISTS client_authorization_codes;
+DROP TABLE IF EXISTS user_application_access;
+DROP INDEX IF EXISTS users_email_unique_idx;
+ALTER TABLE applications
+    DROP COLUMN IF EXISTS redirect_uris,
+    DROP COLUMN IF EXISTS client_secret_hash,
+    DROP COLUMN IF EXISTS client_id;