-- Bot key secrets are now stored as SHA-256 hashes, and the time columns use
-- the TIMESTAMP declared type (like audit_log) so the driver scans them as
-- time.Time. Existing rows hold plaintext secrets that can't verify against
-- the hash path (and were 24h throwaways), so the table is rebuilt rather
-- than migrated in place.
DROP TABLE bot_keys;

CREATE TABLE bot_keys (
    id          TEXT PRIMARY KEY,
    tenant      TEXT NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
    bot         TEXT NOT NULL REFERENCES bots(id) ON DELETE CASCADE,
    secret_hash TEXT NOT NULL,
    created_at  TIMESTAMP NOT NULL,
    expires_at  TIMESTAMP NOT NULL
);

CREATE INDEX idx_bot_keys_bot ON bot_keys(bot);
CREATE INDEX idx_bot_keys_tenant ON bot_keys(tenant);