-- User-managed API keys. key_hash is a salted scrypt digest, so lookups go via
-- the indexed key_prefix rather than the hash.
CREATE TABLE IF NOT EXISTS public.api_key (
    id            BIGSERIAL PRIMARY KEY,
    user_id       BIGINT NOT NULL REFERENCES public.user(id),
    app_id        BIGINT NOT NULL REFERENCES public.app(id),
    label         TEXT,
    key_hash      TEXT NOT NULL,
    key_prefix    TEXT NOT NULL,
    expires_ts    TIMESTAMPTZ,
    last_used_ts  TIMESTAMPTZ,
    created_ts    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    updated_ts    TIMESTAMPTZ NOT NULL DEFAULT NOW()
);
CREATE INDEX IF NOT EXISTS idx__public__api_key__key_prefix   ON public.api_key (key_prefix);
CREATE INDEX IF NOT EXISTS idx__public__api_key__user_id      ON public.api_key (user_id);
CREATE INDEX IF NOT EXISTS idx__public__api_key__app_id       ON public.api_key (app_id);
CREATE INDEX IF NOT EXISTS idx__public__api_key__expires_ts   ON public.api_key (expires_ts);
CREATE INDEX IF NOT EXISTS idx__public__api_key__last_used_ts ON public.api_key (last_used_ts);
CREATE INDEX IF NOT EXISTS idx__public__api_key__created_ts   ON public.api_key (created_ts);
CREATE INDEX IF NOT EXISTS idx__public__api_key__updated_ts   ON public.api_key (updated_ts);