-- User API keys table: stores encrypted LLM provider API keys per user.
-- Each user can have at most one key per provider.

CREATE TABLE user_api_keys (
    id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    user_id         UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
    provider_name   VARCHAR(50) NOT NULL,
    encrypted_key   BYTEA NOT NULL,
    nonce           BYTEA NOT NULL,
    key_prefix      VARCHAR(10) NOT NULL,
    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    updated_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),

    UNIQUE(user_id, provider_name)
);

CREATE INDEX idx_user_api_keys_user_id ON user_api_keys(user_id);