-- =====================================================================
-- tb_auth_token
-- Refresh tokens emitidos pela api.w19.com.br/auth/ (JWT HS256).
-- Access tokens NAO ficam no banco — são stateless (validados via assinatura).
-- Refresh tokens FICAM aqui pra poder revogar (logout, vazamento, mudanca senha).
-- =====================================================================
SET NAMES utf8mb4;

CREATE TABLE IF NOT EXISTS `tb_auth_token` (
  `id_auth_token`         INT(11)      NOT NULL AUTO_INCREMENT,
  `id_user`               INT(11)      NOT NULL,
  `id_project`            INT(11)      NOT NULL,        -- emitido pra qual projeto consumidor

  `auth_token_jti`        VARCHAR(36)  NOT NULL,        -- UUID do refresh token (claim "jti" no JWT)
  `auth_token_expires`    DATETIME     NOT NULL,        -- TTL do refresh (default 7 dias)
  `auth_token_revoked`    TINYINT(1)   NOT NULL DEFAULT 0,
  `auth_token_revoked_at` DATETIME     DEFAULT NULL,
  `auth_token_revoked_reason` VARCHAR(80) DEFAULT NULL, -- 'logout' | 'rotate' | 'security'

  `auth_token_ip`         VARCHAR(45)  DEFAULT NULL,    -- IP de emissao
  `auth_token_user_agent` VARCHAR(255) DEFAULT NULL,    -- UA de emissao (audit)

  `auth_token_created`    DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
  `auth_token_updated`    DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,

  PRIMARY KEY (`id_auth_token`),
  UNIQUE KEY `uk_jti` (`auth_token_jti`),
  KEY `ix_user`    (`id_user`),
  KEY `ix_project` (`id_project`),
  KEY `ix_expires_revoked` (`auth_token_expires`, `auth_token_revoked`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;