-- ===========================================================================
-- Migration: Google SSO (OAuth 2.0)
-- Date: 2026-07-30
--
-- Sign in with Google. The platform admin stores the OAuth client id/secret in
-- app_settings under 'google_oauth' (no schema needed for that). This table
-- just holds the short-lived anti-CSRF `state` values between /auth/google/start
-- and the callback. A matching PFMIS user (by verified Google email) gets a
-- normal session. Idempotent.
-- ===========================================================================

CREATE TABLE IF NOT EXISTS oauth_states (
  state      CHAR(64)  PRIMARY KEY,
  expires_at TIMESTAMP NOT NULL,
  created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
  KEY idx_oauth_expires (expires_at)
) ENGINE=InnoDB;