-- Migration 005: Add vault_path column to credentials table
-- Phase 2 — HashiCorp Vault integration
--
-- New credentials generated after this migration will have their secrets stored
-- in HashiCorp Vault KV v2. The vault_path column stores the Vault KV path
-- (e.g. secret/data/agentidp/agents/{agentId}/credentials/{credentialId}).
--
-- Coexistence strategy:
--   - Rows with vault_path IS NOT NULL → secret verified via Vault
--   - Rows with vault_path IS NULL     → secret verified via secret_hash (bcrypt, Phase 1)
--
-- The secret_hash column is retained for backwards compatibility.
-- Existing credentials continue to work until rotated through the new Vault path.

ALTER TABLE credentials
  ADD COLUMN IF NOT EXISTS vault_path TEXT DEFAULT NULL;

COMMENT ON COLUMN credentials.vault_path IS
  'Vault KV v2 data path for this credential secret. NULL = bcrypt (Phase 1).';
