| 1 | -- Session records. Topcoat issues the raw token to the client and hands us only its | |
| 2 | -- SHA-256 hash, so a dumped database contains nothing anyone could present. | |
| 3 | -- | |
| 4 | -- expires_at is unix seconds. Rows are not self-cleaning: expiry is enforced on read | |
| 5 | -- and swept periodically. | |
| 6 | ( | |
| 7 | token_hash text primary key, | |
| 8 | user_id text not null references users (id) on delete cascade, | |
| 9 | expires_at integer not null | |
| 10 | ); | |
| 11 | ||
| 12 | (expires_at); |