<?php

use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;

return new class extends Migration
{
    /**
     * Device authorization flow (Geekbench-style): the CLI generates a
     * human-typable code + a poll token, the user confirms the code in a
     * browser on the website, and the CLI's next poll receives a Sanctum
     * personal access token. Rows are short-lived and purged opportunistically.
     */
    public function up(): void
    {
        Schema::create('device_codes', function (Blueprint $table) {
            $table->id();
            $table->string('code', 12)->unique();
            $table->string('poll_token_hash', 128);
            $table->foreignId('user_id')->nullable()->constrained()->nullOnDelete();
            $table->foreignId('personal_access_token_id')->nullable();
            // Sanctum hashes tokens; the plaintext exists only at mint time.
            // It is stashed here for exactly one pickup by the CLI's poll,
            // then nulled and never persisted anywhere else.
            $table->string('plain_token')->nullable();
            $table->timestamp('expires_at')->index();
            $table->timestamp('consumed_at')->nullable();
            $table->timestamps();
        });
    }

    public function down(): void
    {
        Schema::dropIfExists('device_codes');
    }
};