Extract API, migrations and portable NAS deployment

database/migrations/003_oidc.sql

@@ -0,0 +1,19 @@
+ALTER TABLE app_users MODIFY COLUMN password_hash VARCHAR(256) NULL;
+ALTER TABLE app_users ADD COLUMN IF NOT EXISTS oidc_identity_hash CHAR(64) CHARACTER SET ascii COLLATE ascii_bin NULL;
+ALTER TABLE app_users ADD COLUMN IF NOT EXISTS oidc_issuer VARCHAR(512) NULL;
+ALTER TABLE app_users ADD COLUMN IF NOT EXISTS oidc_subject VARCHAR(255) NULL;
+ALTER TABLE app_users ADD COLUMN IF NOT EXISTS username_display VARCHAR(255) NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS users_oidc_identity ON app_users(oidc_identity_hash);
+ALTER TABLE auth_sessions ADD COLUMN IF NOT EXISTS auth_provider VARCHAR(10) NOT NULL DEFAULT 'local';
+ALTER TABLE auth_sessions ADD COLUMN IF NOT EXISTS encrypted_tokens TEXT NULL;
+CREATE TABLE IF NOT EXISTS oidc_settings (
+  id TINYINT PRIMARY KEY,
+  encrypted_config TEXT NOT NULL,
+  updated_by CHAR(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+  updated_at VARCHAR(24) NOT NULL
+);
+CREATE TABLE IF NOT EXISTS oidc_transactions (
+  token_hash CHAR(64) CHARACTER SET ascii COLLATE ascii_bin PRIMARY KEY,
+  encrypted_data TEXT NOT NULL,
+  expires_at DATETIME(3) NOT NULL
+);