-- Stores state + nonce during the Beezifi OAuth redirect (10-minute TTL)
CREATE TABLE IF NOT EXISTS beezifi_oauth_states (
  state      CHAR(64)  NOT NULL,
  nonce      CHAR(64)  NOT NULL,
  expires_at DATETIME  NOT NULL,
  PRIMARY KEY (state),
  INDEX idx_beezifi_states_exp (expires_at)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

-- One-time codes returned to the browser after successful Beezifi auth (60-second TTL)
CREATE TABLE IF NOT EXISTS beezifi_auth_codes (
  code          CHAR(64)    NOT NULL,
  access_token  TEXT        NOT NULL,
  refresh_token CHAR(96)    NOT NULL,
  user_id       VARCHAR(36) NOT NULL,
  expires_at    DATETIME    NOT NULL,
  PRIMARY KEY (code),
  INDEX idx_beezifi_codes_exp (expires_at)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
