/**
 * Lets a password change end every session opened before it. Tokens are
 * stateless JWTs, so this adds `users.tokens_valid_after`, and lib/auth.ts
 * refuses a token issued before that time.
 *
 * @module
 */

import type { DatabaseSync } from "node:sqlite";

/**
 * Run once by `runMigrations`. Existing users start with NULL, which revokes no
 * token.
 */
export function up(db: DatabaseSync): void {
  const cols = db.prepare(`PRAGMA table_info(users);`).all() as {
    name: string;
  }[];
  if (!cols.some((c) => c.name === "tokens_valid_after")) {
    db.exec(`ALTER TABLE users ADD COLUMN tokens_valid_after TEXT;`);
  }
}