-- Passwortlose Anmeldung via WebAuthn/Passkey (IAM-10, siehe
-- core-kanban/tickets/IAM-10.md).
CREATE TABLE webauthn_credentials (
    id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    user_id     UUID NOT NULL REFERENCES users(id),
    device_name TEXT NOT NULL,
    public_key  BYTEA NOT NULL,
    sign_count  INT NOT NULL DEFAULT 0,
    created_at  TIMESTAMPTZ NOT NULL DEFAULT now()
);

CREATE INDEX webauthn_credentials_user_idx ON webauthn_credentials (user_id);

-- Einmal-Challenges fuer Registrierung/Anmeldung (Replay-Schutz).
CREATE TABLE webauthn_challenges (
    id         UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    user_id    UUID NOT NULL REFERENCES users(id),
    challenge  TEXT NOT NULL UNIQUE,
    purpose    TEXT NOT NULL CHECK (purpose IN ('register', 'login')),
    expires_at TIMESTAMPTZ NOT NULL,
    used_at    TIMESTAMPTZ,
    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
);