-- ZB.MOM.WW.Auth.ApiKeys.SqlServer — shared API-key schema, version 1.
--
-- For DBAs whose application login lacks DDL rights. The host normally provisions this itself at
-- startup (SqlServerApiKeyStoreMigrator, which runs the identical statements and is safe to run
-- concurrently from every node); where the app login may only read and write rows, run this script
-- once against the target database instead. The migrator then finds the version row already at the
-- version it supports and does nothing further beyond re-stamping applied_utc.
--
-- The schema name is hard-coded to zbauth here — the default of SqlServerApiKeyOptions.Schema. If a
-- deployment overrides that option, substitute the name in every bracketed identifier below.
--
-- Kept byte-for-byte consistent with SqlServerAuthSchema.CreateSchemaDdl apart from that
-- substitution and the literal version row at the end; change both together.

IF NOT EXISTS (SELECT 1 FROM sys.schemas WHERE name = N'zbauth')
    EXEC(N'CREATE SCHEMA [zbauth]');

IF OBJECT_ID(N'[zbauth].[schema_version]', N'U') IS NULL
    CREATE TABLE [zbauth].[schema_version] (
        id          INT               NOT NULL CONSTRAINT PK_zbauth_schema_version PRIMARY KEY CHECK (id = 1),
        version     INT               NOT NULL,
        applied_utc DATETIMEOFFSET(7) NOT NULL
    );

IF OBJECT_ID(N'[zbauth].[api_keys]', N'U') IS NULL
    CREATE TABLE [zbauth].[api_keys] (
        key_id        NVARCHAR(64)      NOT NULL CONSTRAINT PK_zbauth_api_keys PRIMARY KEY,
        key_prefix    NVARCHAR(16)      NOT NULL,
        secret_hash   VARBINARY(64)     NOT NULL,
        display_name  NVARCHAR(256)     NOT NULL,
        scopes        NVARCHAR(MAX)     NOT NULL,
        constraints   NVARCHAR(MAX)     NULL,
        created_utc   DATETIMEOFFSET(7) NOT NULL,
        last_used_utc DATETIMEOFFSET(7) NULL,
        revoked_utc   DATETIMEOFFSET(7) NULL,
        expires_utc   DATETIMEOFFSET(7) NULL
    );

IF OBJECT_ID(N'[zbauth].[api_key_audit]', N'U') IS NULL
    CREATE TABLE [zbauth].[api_key_audit] (
        audit_id       BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_zbauth_api_key_audit PRIMARY KEY,
        key_id         NVARCHAR(64)      NULL,
        event_type     NVARCHAR(64)      NOT NULL,
        remote_address NVARCHAR(64)      NULL,
        created_utc    DATETIMEOFFSET(7) NOT NULL,
        details        NVARCHAR(MAX)     NULL
    );

IF NOT EXISTS (
    SELECT 1 FROM sys.indexes
    WHERE name = N'ix_api_keys_revoked_utc'
      AND object_id = OBJECT_ID(N'[zbauth].[api_keys]'))
    CREATE INDEX ix_api_keys_revoked_utc
        ON [zbauth].[api_keys] (revoked_utc);

IF NOT EXISTS (
    SELECT 1 FROM sys.indexes
    WHERE name = N'ix_api_key_audit_key_id_created_utc'
      AND object_id = OBJECT_ID(N'[zbauth].[api_key_audit]'))
    CREATE INDEX ix_api_key_audit_key_id_created_utc
        ON [zbauth].[api_key_audit] (key_id, created_utc);

MERGE [zbauth].[schema_version] AS target
USING (SELECT 1 AS id, 1 AS version, SYSDATETIMEOFFSET() AS applied_utc) AS source
    ON target.id = source.id
WHEN MATCHED THEN
    UPDATE SET version = source.version, applied_utc = source.applied_utc
WHEN NOT MATCHED THEN
    INSERT (id, version, applied_utc) VALUES (1, source.version, source.applied_utc);