-- ==========================================
-- Chat Switchboard — 019 Auth Providers
-- ==========================================
-- OIDC authorization state tracking.
-- Group source column for OIDC-synced groups.
-- ICD §1 (Users), §2 (Groups) — v0.24.1
-- ==========================================

-- ── OIDC authorization state (short-lived) ───────────────────────
-- Stores state + nonce for the authorization code flow.
-- Rows deleted after callback completes. Stale rows cleaned by age.
CREATE TABLE IF NOT EXISTS oidc_auth_state (
    state       TEXT PRIMARY KEY,
    nonce       TEXT NOT NULL,
    redirect_to TEXT,
    created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

CREATE INDEX IF NOT EXISTS idx_oidc_state_created
    ON oidc_auth_state(created_at);

-- ── Group source tracking ────────────────────────────────────────
-- Distinguishes manually-created groups from OIDC-synced groups.
-- OIDC groups are managed exclusively by the sync process.
ALTER TABLE groups
    ADD COLUMN IF NOT EXISTS source VARCHAR(20) NOT NULL DEFAULT 'manual'
        CHECK (source IN ('manual', 'oidc'));

COMMENT ON TABLE oidc_auth_state IS 'Ephemeral OIDC authorization code flow state. Rows deleted after callback.';
COMMENT ON COLUMN groups.source IS 'manual=admin-created, oidc=synced from IdP groups claim';