| 1 | -- Device authorization grants (RFC 8628-style) for CLI/desktop sign-in. |
| 2 | -- Apply: wrangler d1 migrations apply reasonix-accounts --local (or --remote) |
| 3 | |
| 4 | CREATE TABLE IF NOT EXISTS device_grants ( |
| 5 | device_code_hash TEXT PRIMARY KEY, -- sha256(pepper:device_code); the raw code lives only on the client |
| 6 | user_code TEXT NOT NULL UNIQUE, -- canonical (no separators, upper) code the human types to approve |
| 7 | user_id INTEGER, -- null until approved |
| 8 | status TEXT NOT NULL DEFAULT 'pending', -- pending | approved | denied |
| 9 | kind TEXT NOT NULL DEFAULT 'cli', -- session kind minted on claim (web | cli) |
| 10 | user_agent TEXT NOT NULL DEFAULT '', |
| 11 | created_at TEXT NOT NULL, |
| 12 | last_polled_at TEXT, -- drives the slow_down hint |
| 13 | approved_at TEXT, |
| 14 | expires_at TEXT NOT NULL |
| 15 | ); |
| 16 | CREATE INDEX IF NOT EXISTS device_grants_user_code ON device_grants (user_code); |
| 17 | CREATE INDEX IF NOT EXISTS device_grants_expires ON device_grants (expires_at); |
| 18 |