500 BRaw
| 1 | -- Session records. Topcoat issues the raw token to the client and hands us only its |
| 2 | -- SHA-256 hash, so a dumped database contains nothing anyone could present. |
| 3 | -- |
| 4 | -- expires_at is unix seconds. Rows are not self-cleaning: expiry is enforced on read |
| 5 | -- and swept periodically. |
| 6 | create table sessions ( |
| 7 | token_hash text primary key, |
| 8 | user_id text not null references users (id) on delete cascade, |
| 9 | expires_at integer not null |
| 10 | ); |
| 11 | |
| 12 | create index sessions_expires_at on sessions (expires_at); |