-- Revocable admin sessions.
--
-- Until now an admin-panel token was purely self-contained: once signed it was
-- valid for its full 12h and nothing could cut it short — not deactivating the
-- account, not a central "sign out everywhere". Connecting the central IAM made
-- that gap concrete, because an IAM session revocation had no effect on a token
-- this API had already issued.
--
-- Each issued token now carries a `jti` recorded here, and JwtStrategy rejects a
-- token whose row is revoked. Rows are only written (and only enforced) while
-- session tracking is enabled, so a deployment that leaves it off keeps exactly
-- the previous behaviour and the previous query count.
CREATE TABLE "AdminSession" (
    "id" TEXT NOT NULL,
    "jti" TEXT NOT NULL,
    "adminUserId" TEXT NOT NULL,
    "iamSessionId" TEXT,
    "iamSub" TEXT,
    "ipAddress" TEXT,
    "userAgent" TEXT,
    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
    "expiresAt" TIMESTAMP(3),
    "lastSeenAt" TIMESTAMP(3),
    "revokedAt" TIMESTAMP(3),
    "revokedReason" TEXT,

    CONSTRAINT "AdminSession_pkey" PRIMARY KEY ("id")
);

CREATE UNIQUE INDEX "AdminSession_jti_key" ON "AdminSession"("jti");
CREATE INDEX "AdminSession_adminUserId_idx" ON "AdminSession"("adminUserId");
CREATE INDEX "AdminSession_iamSessionId_idx" ON "AdminSession"("iamSessionId");
CREATE INDEX "AdminSession_iamSub_idx" ON "AdminSession"("iamSub");
CREATE INDEX "AdminSession_expiresAt_idx" ON "AdminSession"("expiresAt");

ALTER TABLE "AdminSession"
    ADD CONSTRAINT "AdminSession_adminUserId_fkey"
    FOREIGN KEY ("adminUserId") REFERENCES "AdminUser"("id") ON DELETE CASCADE ON UPDATE CASCADE;