"""HMAC signing keys for per-turn JWTs minted by Daedalus.

Adds the MCPSigningKey table. Per-turn tokens (workspace + library claims,
exp <= 600s) are not stored — only the signing key, indexed by ``kid``,
so the signature can be validated and rotated cleanly.
"""

from django.db import migrations, models


class Migration(migrations.Migration):
    dependencies = [
        ("mcp_server", "0002_hash_token"),
    ]

    operations = [
        migrations.CreateModel(
            name="MCPSigningKey",
            fields=[
                (
                    "id",
                    models.BigAutoField(
                        auto_created=True,
                        primary_key=True,
                        serialize=False,
                        verbose_name="ID",
                    ),
                ),
                ("kid", models.CharField(max_length=64, unique=True, db_index=True)),
                ("secret_hex", models.CharField(max_length=128)),
                ("is_active", models.BooleanField(default=True)),
                ("created_at", models.DateTimeField(auto_now_add=True)),
                ("retired_at", models.DateTimeField(blank=True, null=True)),
                ("note", models.TextField(blank=True)),
            ],
            options={"ordering": ["-created_at"]},
        ),
    ]
