-- =====================================================================
-- AI Front Desk Platform — Migration 005
--
-- Admin portal auth. Session state itself lives in PHP's native session
-- handler (file-based by default; swap the handler, not this schema, if
-- you later move to Redis/DB-backed sessions across multiple app
-- servers). This migration only adds what can't live in a session:
-- a long-lived "remember me" token, checked on new sessions to
-- transparently re-authenticate the user without re-prompting for a
-- password.
--
-- Token design: a random selector (looked up, indexed, safe to expose
-- in a cookie) + a hashed verifier (never stored raw, compared with
-- hash_equals) — the standard split-token pattern. This avoids the two
-- common mistakes: storing a bare token (a DB read discloses a valid
-- cookie value) and using the token itself as a lookup key (timing
-- attack on the lookup query).
-- =====================================================================

SET NAMES utf8mb4;

ALTER TABLE users
    ADD COLUMN remember_token_selector VARCHAR(24)  NULL
        COMMENT 'Random lookup key, sent as part of the remember-me cookie value',
    ADD COLUMN remember_token_verifier_hash VARCHAR(255) NULL
        COMMENT 'password_hash() of the verifier half of the remember-me cookie; never store the raw verifier',
    ADD COLUMN remember_token_expires_at DATETIME NULL,
    ADD UNIQUE KEY uq_users_remember_selector (remember_token_selector);