-- Issue #106 — bind cluster tokens to a specific hostname so a compromised
-- worker token can't be used to hijack another node's `api_url` via
-- POST /cluster/heartbeat.
--
-- `bound_hostname` is NULL for ordinary user tokens (no binding) and set
-- to the node's hostname for node-agent tokens. The heartbeat handler
-- checks that body.hostname === token.bound_hostname when bound_hostname
-- is non-null.

ALTER TABLE api_tokens
  ADD COLUMN IF NOT EXISTS bound_hostname TEXT;

CREATE INDEX IF NOT EXISTS api_tokens_bound_hostname_idx
  ON api_tokens (bound_hostname)
  WHERE bound_hostname IS NOT NULL;
