-- Device sign-in (oxygenhub#67, RFC 8628 in shape): an app holds the

-- device code (stored as its hash) and polls; the user approves the user

-- code on the web, choosing the scopes; the token is made when the app

-- next polls, so no token is stored in the clear.

CREATE TABLE device_codes (

    id              INTEGER PRIMARY KEY,

    device_hash     TEXT NOT NULL UNIQUE,

    user_code       TEXT NOT NULL UNIQUE,

    client          TEXT NOT NULL,

    scopes          TEXT NOT NULL,

    created_ms      INTEGER NOT NULL,

    expires_ms      INTEGER NOT NULL,

    last_poll_ms    INTEGER NOT NULL DEFAULT 0,

    account_id      INTEGER REFERENCES accounts(id) ON DELETE CASCADE,

    approved_scopes TEXT NOT NULL DEFAULT '',

    denied          INTEGER NOT NULL DEFAULT 0

);