-- JWT Authentication Migration
-- Creates the refresh_tokens table for tracking active refresh tokens
-- Only the SHA-256 hash of each token is stored, never the raw token

CREATE TABLE IF NOT EXISTS refresh_tokens (
    id INT AUTO_INCREMENT PRIMARY KEY,
    entity_id INT NOT NULL COMMENT 'References customer_entity.entity_id',
    token_hash VARCHAR(64) NOT NULL COMMENT 'SHA-256 hash of the refresh token',
    expires_at DATETIME NOT NULL COMMENT 'Token expiration timestamp',
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
    is_revoked TINYINT(1) DEFAULT 0 COMMENT '1 = revoked (logout/password change)',
    INDEX idx_entity_id (entity_id),
    INDEX idx_token_hash (token_hash),
    INDEX idx_expires (expires_at)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;