[
  {
    "type": "create_table",
    "description": "Create oauthRefreshTokens table for JWT refresh token storage",
    "database": "kiosk_users",
    "check_query": "SHOW TABLES LIKE 'oauthRefreshTokens'",
    "sql": "CREATE TABLE `oauthRefreshTokens` (\n  `id` int(10) unsigned NOT NULL AUTO_INCREMENT,\n  `userId` int(10) unsigned NOT NULL COMMENT 'FK to users.id',\n  `token` varchar(255) NOT NULL COMMENT 'Hashed refresh token',\n  `clientId` varchar(100) DEFAULT NULL COMMENT 'OAuth client identifier',\n  `deviceName` varchar(255) DEFAULT NULL COMMENT 'Device friendly name',\n  `deviceFingerprint` varchar(255) DEFAULT NULL COMMENT 'Device fingerprint hash',\n  `ipAddress` varchar(45) DEFAULT NULL COMMENT 'Token creation IP',\n  `userAgent` text DEFAULT NULL,\n  `expiresAt` timestamp NOT NULL COMMENT 'Token expiration time',\n  `revokedAt` timestamp NULL DEFAULT NULL COMMENT 'When token was revoked',\n  `lastUsedAt` timestamp NULL DEFAULT NULL COMMENT 'Last token usage',\n  `createdAt` timestamp NOT NULL DEFAULT current_timestamp(),\n  PRIMARY KEY (`id`),\n  UNIQUE KEY `uk_token` (`token`),\n  KEY `idx_userId` (`userId`),\n  KEY `idx_userExpires` (`userId`, `expiresAt`),\n  KEY `idx_revokedAt` (`revokedAt`),\n  CONSTRAINT `fk_oauthRefreshTokens_user` FOREIGN KEY (`userId`) REFERENCES `users` (`id`) ON DELETE CASCADE ON UPDATE CASCADE\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='OAuth2 refresh token storage'"
  }
]