-- Sessions as server-side records (oxygenhub#223). The cookie holds a

-- random id; only its hash is kept here. A session is good while its salt

-- matches the account's (a new password or "sign out everywhere" ends them

-- all), it has been used in the last 14 days, and it is under 30 days old.

CREATE TABLE sessions (

    id INTEGER PRIMARY KEY,

    account_id INTEGER NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,

    hash TEXT NOT NULL UNIQUE,

    salt TEXT NOT NULL,

    created_ms INTEGER NOT NULL,

    seen_ms INTEGER NOT NULL,

    address TEXT NOT NULL DEFAULT '',

    agent TEXT NOT NULL DEFAULT ''

);

CREATE INDEX sessions_account ON sessions(account_id);