synctv/migrations/20260426002_create_auth_password_credentials.sql

CREATE TABLE IF NOT EXISTS auth_password_credentials (
    user_id BIGINT PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
    legacy_password_hash TEXT,
    legacy_password_algorithm VARCHAR(64),
    opaque_record BYTEA,
    opaque_credential_identifier BYTEA,
    opaque_ciphersuite VARCHAR(64),
    opaque_server_setup_version INTEGER,
    password_changed_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
    password_version INTEGER NOT NULL DEFAULT 0,
    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,

    CONSTRAINT auth_password_credentials_legacy_algorithm_required
        CHECK (
            (legacy_password_hash IS NULL AND legacy_password_algorithm IS NULL)
            OR (legacy_password_hash IS NOT NULL AND legacy_password_algorithm IS NOT NULL)
        ),
    CONSTRAINT auth_password_credentials_opaque_metadata_required
        CHECK (
            (
                opaque_record IS NULL
                AND opaque_credential_identifier IS NULL
                AND opaque_ciphersuite IS NULL
                AND opaque_server_setup_version IS NULL
            )
            OR (
                opaque_record IS NOT NULL
                AND opaque_credential_identifier IS NOT NULL
                AND opaque_ciphersuite IS NOT NULL
                AND opaque_server_setup_version IS NOT NULL
            )
        )
);

CREATE INDEX IF NOT EXISTS idx_auth_password_credentials_password_changed_at
    ON auth_password_credentials(password_changed_at);

CREATE TRIGGER update_auth_password_credentials_updated_at
    BEFORE UPDATE ON auth_password_credentials
    FOR EACH ROW
    EXECUTE FUNCTION update_updated_at_column();

COMMENT ON TABLE auth_password_credentials IS 'Password-based authentication credentials; supported methods are inferred from non-null credential columns';
COMMENT ON COLUMN auth_password_credentials.user_id IS 'User that owns this password credential set';
COMMENT ON COLUMN auth_password_credentials.legacy_password_hash IS 'Legacy password hash in PHC format when password login is enabled';
COMMENT ON COLUMN auth_password_credentials.legacy_password_algorithm IS 'Algorithm identifier for legacy_password_hash, for example argon2id';
COMMENT ON COLUMN auth_password_credentials.opaque_record IS 'OPAQUE password registration record when OPAQUE login is enabled';
COMMENT ON COLUMN auth_password_credentials.opaque_credential_identifier IS 'Stable OPAQUE credential identifier used to derive per-user OPRF key material';
COMMENT ON COLUMN auth_password_credentials.opaque_ciphersuite IS 'OPAQUE ciphersuite identifier used to create opaque_record';
COMMENT ON COLUMN auth_password_credentials.opaque_server_setup_version IS 'Version of the OPAQUE server setup used to create opaque_record';
COMMENT ON COLUMN auth_password_credentials.password_changed_at IS 'Timestamp of last password credential change';
COMMENT ON COLUMN auth_password_credentials.password_version IS 'Monotonically increasing password credential version used to invalidate tokens';