pub const AUTH_MIGRATION: &str = "-- Local accounts (ADR-0021 \u{a7} 2): written by puerto, after `users`. The password hash lives apart\n-- from the user, so `users` carries no secret. A session row keeps the SHA-256 of its token, never\n-- the token: a copy of this table opens no session. Both go with their user. Expired sessions are\n-- refused, not deleted: pruning them (`DELETE FROM sessions WHERE expires_at < now()`) is yours.\n\nCREATE TABLE credentials (\n user_id UUID PRIMARY KEY REFERENCES users (id) ON DELETE CASCADE,\n password_hash TEXT NOT NULL,\n updated_at TIMESTAMPTZ NOT NULL DEFAULT now()\n);\n\nCREATE TABLE sessions (\n token_hash BYTEA PRIMARY KEY,\n user_id UUID NOT NULL REFERENCES users (id) ON DELETE CASCADE,\n created_at TIMESTAMPTZ NOT NULL DEFAULT now(),\n expires_at TIMESTAMPTZ NOT NULL\n);\n\nCREATE INDEX sessions_user_id_idx ON sessions (user_id);\n";Expand description
The credentials and sessions of local accounts (migrations/auth.sql), after
USERS_MIGRATION. Puerto’s CLI ships a byte-for-byte copy of it as a project migration.