-- Run once on existing databases: adds app login + bearer tokens for the mobile app.
-- mysql -u USER -p DATABASE < add_app_users_auth.sql
--
-- For a clean reinstall (drops all HLM tables + recreates), use instead:
--   database/hlm_full_import.sql

ALTER TABLE users
  ADD COLUMN password_hash VARCHAR(255) NULL AFTER email;

CREATE TABLE IF NOT EXISTS app_access_tokens (
  id INT AUTO_INCREMENT PRIMARY KEY,
  user_id INT NOT NULL,
  token_hash CHAR(64) NOT NULL,
  created_at DATETIME NOT NULL,
  UNIQUE KEY uq_app_token_hash (token_hash),
  KEY idx_app_token_user (user_id),
  CONSTRAINT fk_app_token_user FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
