-- auth_identities — lets a local-password identity and a future OIDC identity map to the same
-- instructor record without a schema change when OIDC lands. Every instructor gets a 'local'
-- row today (provider_subject = their own instructor_id as text); a Google/OIDC login later
-- just adds a second row for the same instructor_id. See
-- docs/PHASE3A_IDENTITY_AND_INSTRUCTOR_ACCESS.md for the adapter interface this backs.

CREATE TABLE IF NOT EXISTS auth_identities (
  auth_identity_id  UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  instructor_id     UUID NOT NULL REFERENCES instructors(instructor_id) ON DELETE CASCADE,
  provider          TEXT NOT NULL,        -- 'local' | 'google' | 'oidc:<name>'
  provider_subject  TEXT NOT NULL,
  provider_email    TEXT,
  created_at        TIMESTAMPTZ NOT NULL DEFAULT now(),
  last_login_at     TIMESTAMPTZ,
  UNIQUE (provider, provider_subject)
);

CREATE INDEX IF NOT EXISTS idx_auth_identities_instructor ON auth_identities(instructor_id);