CREATE TYPE "RefreshTokenStatus" AS ENUM ('ACTIVE', 'USED');

CREATE TABLE "refresh_tokens" (
  "id" UUID NOT NULL,
  "token_hash" VARCHAR(255) NOT NULL,
  "session_id" UUID NOT NULL,
  "generation" INTEGER NOT NULL,
  "status" "RefreshTokenStatus" NOT NULL DEFAULT 'ACTIVE',
  "used_at" TIMESTAMPTZ(3),
  "replaced_by_hash" VARCHAR(255),
  "created_at" TIMESTAMPTZ(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
  "expires_at" TIMESTAMPTZ(3) NOT NULL,
  CONSTRAINT "refresh_tokens_pkey" PRIMARY KEY ("id"),
  CONSTRAINT "refresh_tokens_generation_nonnegative" CHECK ("generation" >= 0),
  CONSTRAINT "refresh_tokens_used_state_consistent" CHECK (
    ("status" = 'ACTIVE' AND "used_at" IS NULL AND "replaced_by_hash" IS NULL)
    OR ("status" = 'USED' AND "used_at" IS NOT NULL AND "replaced_by_hash" IS NOT NULL)
  )
);

-- Legacy refresh values exposed the session id and cannot be upgraded client-side.
-- Revoke those families; subsequent logins create opaque token history rows.
UPDATE "sessions" SET "revoked_at" = COALESCE("revoked_at", CURRENT_TIMESTAMP);

CREATE UNIQUE INDEX "refresh_tokens_token_hash_key" ON "refresh_tokens"("token_hash");
CREATE UNIQUE INDEX "refresh_tokens_replaced_by_hash_key" ON "refresh_tokens"("replaced_by_hash");
CREATE UNIQUE INDEX "refresh_tokens_session_id_generation_key" ON "refresh_tokens"("session_id", "generation");
CREATE INDEX "refresh_tokens_session_id_status_idx" ON "refresh_tokens"("session_id", "status");
CREATE INDEX "refresh_tokens_expires_at_idx" ON "refresh_tokens"("expires_at");
ALTER TABLE "refresh_tokens" ADD CONSTRAINT "refresh_tokens_session_id_fkey"
  FOREIGN KEY ("session_id") REFERENCES "sessions"("id") ON DELETE CASCADE ON UPDATE CASCADE;