-- Auth sessions: opaque cookie token → user_id mapping.
-- We avoid JWT to keep the dependency footprint small; revocation is just DELETE.

CREATE TABLE session (
  session_id  TEXT PRIMARY KEY,
  user_id     TEXT NOT NULL REFERENCES app_user(user_id) ON DELETE CASCADE,
  expires_at  TEXT NOT NULL,
  created_at  TEXT NOT NULL DEFAULT (datetime('now'))
);

CREATE INDEX session_user_idx ON session(user_id);
CREATE INDEX session_expires_idx ON session(expires_at);