-- Learner package: Better Auth tables (snake_case, ISO-8601 TEXT dates, INTEGER booleans) and helpers.
-- Portable SQL: runs unchanged on SQLite and Postgres.
CREATE TABLE auth_user (
  id TEXT PRIMARY KEY, name TEXT NOT NULL, email TEXT NOT NULL UNIQUE, email_verified INTEGER NOT NULL,
  image TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
);
CREATE TABLE auth_session (
  id TEXT PRIMARY KEY, expires_at TEXT NOT NULL, token TEXT NOT NULL UNIQUE,
  created_at TEXT NOT NULL, updated_at TEXT NOT NULL, ip_address TEXT, user_agent TEXT,
  user_id TEXT NOT NULL
);
CREATE INDEX auth_session_by_user ON auth_session (user_id);
CREATE TABLE auth_account (
  id TEXT PRIMARY KEY, account_id TEXT NOT NULL, provider_id TEXT NOT NULL, user_id TEXT NOT NULL,
  access_token TEXT, refresh_token TEXT, id_token TEXT, access_token_expires_at TEXT, refresh_token_expires_at TEXT,
  scope TEXT, password TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
);
CREATE INDEX auth_account_by_user ON auth_account (user_id);
CREATE TABLE auth_verification (
  id TEXT PRIMARY KEY, identifier TEXT NOT NULL, value TEXT NOT NULL, expires_at TEXT NOT NULL,
  created_at TEXT NOT NULL, updated_at TEXT NOT NULL
);
CREATE INDEX auth_verification_by_identifier ON auth_verification (identifier);
CREATE TABLE auth_sso_provider (
  id TEXT PRIMARY KEY, issuer TEXT NOT NULL, oidc_config TEXT, saml_config TEXT, user_id TEXT,
  provider_id TEXT NOT NULL UNIQUE, organization_id TEXT, domain TEXT NOT NULL, domain_verified INTEGER
);
-- key/value for one-off facts such as which user claimed the owner role first
CREATE TABLE learner_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL);
-- group memberships that came from SAML/OIDC claims (replaced on each sign-in; manual ones are not listed here)
CREATE TABLE learner_group_claims (
  user_id TEXT NOT NULL, group_id TEXT NOT NULL,
  PRIMARY KEY (user_id, group_id)
);