-- Migration: 002_create_credentials
-- Creates the credentials table for the Credential Management service.

CREATE TABLE IF NOT EXISTS credentials (
  credential_id   UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  client_id       UUID         NOT NULL REFERENCES agents(agent_id) ON DELETE CASCADE,
  secret_hash     VARCHAR(255) NOT NULL,
  status          VARCHAR(16)  NOT NULL DEFAULT 'active',
  created_at      TIMESTAMPTZ  NOT NULL DEFAULT NOW(),
  expires_at      TIMESTAMPTZ,
  revoked_at      TIMESTAMPTZ,

  CONSTRAINT credentials_status_check
    CHECK (status IN ('active','revoked'))
);

CREATE INDEX IF NOT EXISTS idx_credentials_client_id   ON credentials (client_id);
CREATE INDEX IF NOT EXISTS idx_credentials_status      ON credentials (status);
CREATE INDEX IF NOT EXISTS idx_credentials_created_at  ON credentials (created_at DESC);
