-- ============================================================================
-- Migration: Add Token Rotation Columns
-- Date: 2026-01-27
-- Author: Claude Code (BLOCKER-001 Token Refresh Improvements)
-- ============================================================================

-- Add columns for token rotation security
ALTER TABLE auth.sessions
  ADD COLUMN IF NOT EXISTS refresh_token_hash VARCHAR(64),
  ADD COLUMN IF NOT EXISTS refresh_token_issued_at TIMESTAMPTZ;

-- Add comments
COMMENT ON COLUMN auth.sessions.refresh_token_hash IS 'SHA-256 hash of refresh token for rotation security';
COMMENT ON COLUMN auth.sessions.refresh_token_issued_at IS 'Timestamp when current refresh token was issued';

-- Create index for performance (hash lookups)
CREATE INDEX IF NOT EXISTS idx_sessions_refresh_token_hash ON auth.sessions(refresh_token_hash);