-- oidc_keys: stores RSA-2048 or EC P-256 signing key pairs for OIDC ID token issuance.
-- Only one key is current at a time. Old keys remain in the table until all tokens
-- signed with them have expired (key rotation grace period).
CREATE TABLE IF NOT EXISTS oidc_keys (
  id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  kid           VARCHAR(64) NOT NULL UNIQUE,   -- Key ID, e.g. "key-20260330-001"
  algorithm     VARCHAR(16) NOT NULL,           -- "RS256" or "ES256"
  public_key_jwk JSONB NOT NULL,               -- Public key in JWK format
  vault_key_path VARCHAR(512) NOT NULL,         -- Vault KV2 path for private key
  is_current    BOOLEAN NOT NULL DEFAULT FALSE,
  created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  expires_at    TIMESTAMPTZ NOT NULL            -- when tokens signed with this key all expire
);
CREATE INDEX IF NOT EXISTS idx_oidc_keys_is_current ON oidc_keys(is_current) WHERE is_current = TRUE;
CREATE INDEX IF NOT EXISTS idx_oidc_keys_expires_at ON oidc_keys(expires_at);
