···11+-- Temporary state during the OAuth authorization flow.
22+-- Each row represents an in-progress login attempt.
33+-- Deleted after the callback completes (or on expiry).
44+CREATE TABLE IF NOT EXISTS oauth_auth_request (
55+ state TEXT NOT NULL PRIMARY KEY,
66+ authserver_iss TEXT NOT NULL,
77+ did TEXT,
88+ handle TEXT,
99+ pds_url TEXT,
1010+ pkce_verifier TEXT NOT NULL,
1111+ scope TEXT NOT NULL,
1212+ dpop_authserver_nonce TEXT NOT NULL,
1313+ dpop_private_jwk TEXT NOT NULL
1414+);
1515+1616+-- Active authenticated sessions.
1717+-- One row per logged-in user. Tokens are refreshed in place.
1818+CREATE TABLE IF NOT EXISTS oauth_session (
1919+ did TEXT NOT NULL PRIMARY KEY,
2020+ handle TEXT,
2121+ pds_url TEXT NOT NULL,
2222+ authserver_iss TEXT NOT NULL,
2323+ access_token TEXT,
2424+ refresh_token TEXT,
2525+ dpop_authserver_nonce TEXT NOT NULL,
2626+ dpop_pds_nonce TEXT,
2727+ dpop_private_jwk TEXT NOT NULL
2828+);