---
# arrproxy schema, mirrored from the arrproxy repo migrations/ (v0.5.0).
# arrproxy-api does NOT self-migrate, so the wave-1 migrate Job applies these in
# order once per sync as the app user. Every statement is idempotent, so a resync
# over an already-migrated database is a no-op. Keep in sync with the repo on
# schema bumps.
apiVersion: v1
kind: ConfigMap
metadata:
  name: arrproxy-migrations
  namespace: arrstack
  annotations:
    argocd.argoproj.io/sync-wave: "0"
data:
  0001_init.sql: |
    -- arrproxy token store. Only token hashes are persisted; plaintext is shown
    -- once at mint time and never recoverable.
    CREATE TABLE IF NOT EXISTS tokens (
        id           TEXT PRIMARY KEY,
        subject      TEXT        NOT NULL,
        label        TEXT        NOT NULL DEFAULT '',
        token_hash   TEXT        NOT NULL UNIQUE,
        apps         TEXT[]      NOT NULL DEFAULT '{}',
        created_at   TIMESTAMPTZ NOT NULL DEFAULT now(),
        expires_at   TIMESTAMPTZ,
        disabled     BOOLEAN     NOT NULL DEFAULT false,
        last_used_at TIMESTAMPTZ
    );

    CREATE INDEX IF NOT EXISTS tokens_subject_idx ON tokens (subject);
    CREATE INDEX IF NOT EXISTS tokens_token_hash_idx ON tokens (token_hash);
  0002_tier_tokens.sql: |
    -- Tier-scoped virtual API keys. Existing rows (tier '') remain legacy per-app
    -- tokens validated on the unprefixed routes; tier keys carry a tier name and,
    -- for read-only tiers (kids), read_only=true so writes are rejected.
    ALTER TABLE tokens ADD COLUMN IF NOT EXISTS tier      TEXT    NOT NULL DEFAULT '';
    ALTER TABLE tokens ADD COLUMN IF NOT EXISTS read_only BOOLEAN NOT NULL DEFAULT false;
  0003_token_methods.sql: |
    -- Per-token HTTP method scoping. An empty list (the default every existing row
    -- gets) means unrestricted, so tokens minted before this column behave exactly
    -- as before; a non-empty list limits the token to those methods.
    ALTER TABLE tokens ADD COLUMN IF NOT EXISTS methods TEXT[] NOT NULL DEFAULT '{}';