-- SAML 2.0 SSO configuration table
-- Migration 022: SAML SSO

CREATE TABLE IF NOT EXISTS saml_configs (
  id            VARCHAR(36)  PRIMARY KEY DEFAULT (UUID()),
  tenant_id     VARCHAR(36)  NOT NULL UNIQUE,
  entity_id     VARCHAR(500) NOT NULL COMMENT 'IdP Entity ID / Issuer',
  sso_url       VARCHAR(500) NOT NULL COMMENT 'IdP SSO redirect URL',
  slo_url       VARCHAR(500) NULL        COMMENT 'IdP SLO URL (optional)',
  certificate   TEXT         NOT NULL    COMMENT 'IdP X.509 signing certificate (PEM, no headers)',
  name_id_format VARCHAR(200) NOT NULL DEFAULT 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
  attribute_mapping JSON NULL COMMENT 'Map IdP attrs to user fields e.g. {"email":"email","firstName":"firstName"}',
  enabled       BOOLEAN      NOT NULL DEFAULT TRUE,
  created_at    DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
  updated_at    DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  CONSTRAINT fk_saml_tenant FOREIGN KEY (tenant_id) REFERENCES tenants(id) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
