/**
 * Changing or resetting a password must end every session opened before it.
 * Tokens are stateless JWTs, so each user carries a cut-off instead:
 * `users.tokens_valid_after` (ISO), and a token issued before it is refused.
 * NULL — the state every existing user starts in — means no cut-off.
 *
 * Idempotent: also runs against fresh databases created from schema.sql, where
 * the column already exists.
 *
 * @module
 */

import type { DatabaseSync } from "node:sqlite";

/** Applies this migration to `db`. */
export function up(db: DatabaseSync): void {
  const cols = db.prepare(`PRAGMA table_info(users);`).all() as {
    name: string;
  }[];
  if (!cols.some((c) => c.name === "tokens_valid_after")) {
    db.exec(`ALTER TABLE users ADD COLUMN tokens_valid_after TEXT;`);
  }
}