Release 0.7.3

migrations/0020_oauth_mcp.sql

@@ -0,0 +1,49 @@
+CREATE TABLE oauth_clients (
+	id TEXT PRIMARY KEY,
+	name TEXT NOT NULL,
+	redirect_uris_json TEXT NOT NULL CHECK (json_valid(redirect_uris_json)),
+	created_at_utc TEXT NOT NULL
+);
+
+CREATE TABLE oauth_authorization_codes (
+	code_hash TEXT PRIMARY KEY,
+	client_id TEXT NOT NULL REFERENCES oauth_clients(id) ON DELETE CASCADE,
+	user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+	redirect_uri TEXT NOT NULL,
+	scope TEXT NOT NULL,
+	resource TEXT NOT NULL,
+	code_challenge TEXT NOT NULL,
+	created_at_utc TEXT NOT NULL,
+	expires_at_utc TEXT NOT NULL,
+	consumed_at_utc TEXT
+);
+
+CREATE INDEX oauth_authorization_codes_expiry_idx
+	ON oauth_authorization_codes(expires_at_utc);
+
+CREATE TABLE oauth_access_tokens (
+	token_hash TEXT PRIMARY KEY,
+	client_id TEXT NOT NULL REFERENCES oauth_clients(id) ON DELETE CASCADE,
+	user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+	scope TEXT NOT NULL,
+	resource TEXT NOT NULL,
+	created_at_utc TEXT NOT NULL,
+	expires_at_utc TEXT NOT NULL,
+	last_used_at_utc TEXT,
+	request_window_started_at_utc TEXT NOT NULL,
+	request_count INTEGER NOT NULL DEFAULT 0 CHECK (request_count >= 0),
+	revoked_at_utc TEXT
+);
+
+CREATE INDEX oauth_access_tokens_user_idx ON oauth_access_tokens(user_id);
+CREATE INDEX oauth_access_tokens_expiry_idx ON oauth_access_tokens(expires_at_utc);
+
+CREATE TABLE oauth_rate_limit_attempts (
+	id TEXT PRIMARY KEY,
+	kind TEXT NOT NULL CHECK (kind IN ('registration', 'token')),
+	address_hash TEXT NOT NULL,
+	attempted_at_utc TEXT NOT NULL
+);
+
+CREATE INDEX oauth_rate_limit_attempts_lookup_idx
+	ON oauth_rate_limit_attempts(kind, address_hash, attempted_at_utc);