-- Migration: 022_add_github_oidc_trust_policies
-- Creates the oidc_trust_policies table for GitHub OIDC token exchange enforcement.
-- Only workflows matching a registered trust policy may exchange a GitHub OIDC token
-- for a SentryAgent.ai agent access token.

CREATE TABLE IF NOT EXISTS oidc_trust_policies (
  id             UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
  provider       VARCHAR(64) NOT NULL,           -- e.g. 'github'
  repository     VARCHAR(255) NOT NULL,           -- e.g. 'org/repo'
  branch         VARCHAR(255),                    -- optional branch constraint; NULL = any branch
  agent_id       UUID        NOT NULL REFERENCES agents(agent_id) ON DELETE CASCADE,
  created_at     TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  updated_at     TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

-- Index for fast trust policy lookup during OIDC token exchange
CREATE INDEX IF NOT EXISTS idx_trust_policies_provider_repo
  ON oidc_trust_policies (provider, repository);

-- Index for looking up all policies for a given agent
CREATE INDEX IF NOT EXISTS idx_trust_policies_agent_id
  ON oidc_trust_policies (agent_id);
