-- GoChat SAML Configuration Tables
-- Reference: P2E §1.6 — SAML SP integration for enterprise SSO
-- Stores SAML IdP metadata, SP configuration, and attribute mapping

-- SAML Configurations (per-account SAML settings)
CREATE TABLE IF NOT EXISTS saml_configs (
    id SERIAL PRIMARY KEY,
    account_id INTEGER NOT NULL UNIQUE,
    enabled BOOLEAN DEFAULT FALSE,
    idp_metadata_url VARCHAR(1024),
    idp_metadata_xml TEXT,
    sp_entity_id VARCHAR(255) NOT NULL,
    acs_url VARCHAR(1024) NOT NULL,
    sp_private_key TEXT,
    sp_certificate TEXT,
    clock_drift_tolerance INTEGER DEFAULT 180,
    attribute_map JSONB DEFAULT '{}',
    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
    updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
    deleted_at TIMESTAMP WITH TIME ZONE
);

CREATE INDEX idx_saml_configs_deleted_at ON saml_configs(deleted_at);
CREATE INDEX idx_saml_configs_account_id ON saml_configs(account_id) WHERE deleted_at IS NULL;

-- SAML Sessions (tracks SAML-initiated auth sessions)
CREATE TABLE IF NOT EXISTS saml_sessions (
    id SERIAL PRIMARY KEY,
    account_id INTEGER NOT NULL,
    user_id INTEGER,
    request_id VARCHAR(255) NOT NULL UNIQUE,
    name_id VARCHAR(255),
    session_index VARCHAR(255),
    sso_url VARCHAR(1024),
    slo_url VARCHAR(1024),
    expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
    updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
);

CREATE INDEX idx_saml_sessions_request_id ON saml_sessions(request_id);
CREATE INDEX idx_saml_sessions_expires_at ON saml_sessions(expires_at);
CREATE INDEX idx_saml_sessions_account_id ON saml_sessions(account_id);