Changeset 0.24.1 (#157)

server/database/migrations/019_auth_providers.sql

@@ -0,0 +1,30 @@
+-- ==========================================
+-- Chat Switchboard — 019 Auth Providers
+-- ==========================================
+-- OIDC authorization state tracking.
+-- Group source column for OIDC-synced groups.
+-- ICD §1 (Users), §2 (Groups) — v0.24.1
+-- ==========================================
+
+-- ── OIDC authorization state (short-lived) ───────────────────────
+-- Stores state + nonce for the authorization code flow.
+-- Rows deleted after callback completes. Stale rows cleaned by age.
+CREATE TABLE IF NOT EXISTS oidc_auth_state (
+    state       TEXT PRIMARY KEY,
+    nonce       TEXT NOT NULL,
+    redirect_to TEXT,
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_oidc_state_created
+    ON oidc_auth_state(created_at);
+
+-- ── Group source tracking ────────────────────────────────────────
+-- Distinguishes manually-created groups from OIDC-synced groups.
+-- OIDC groups are managed exclusively by the sync process.
+ALTER TABLE groups
+    ADD COLUMN IF NOT EXISTS source VARCHAR(20) NOT NULL DEFAULT 'manual'
+        CHECK (source IN ('manual', 'oidc'));
+
+COMMENT ON TABLE oidc_auth_state IS 'Ephemeral OIDC authorization code flow state. Rows deleted after callback.';
+COMMENT ON COLUMN groups.source IS 'manual=admin-created, oidc=synced from IdP groups claim';

server/database/migrations/sqlite/019_auth_providers.sql

@@ -0,0 +1,13 @@
+-- Chat Switchboard — 019 Auth Providers (SQLite) (v0.24.1)
+
+CREATE TABLE IF NOT EXISTS oidc_auth_state (
+    state       TEXT PRIMARY KEY,
+    nonce       TEXT NOT NULL,
+    redirect_to TEXT,
+    created_at  TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_oidc_state_created
+    ON oidc_auth_state(created_at);
+
+ALTER TABLE groups ADD COLUMN source TEXT NOT NULL DEFAULT 'manual';