-- 008_steam_credentials.sql — operator's cached Steam login for SteamCMD.
--
-- Some games (DayZ app 223350, Arma, a handful of others) require a Steam
-- account that owns the game — anonymous SteamCMD login returns
-- "No subscription". The panel stores one Steam credential per operator
-- (for v1 we only support single-user mode, so a single row is enough).
--
-- password_ciphertext is AES-GCM encrypted using a key derived from the
-- controller's CA private key via HKDF-SHA256; see auth.go's
-- steamCredentialKey(). The plaintext password never touches disk or logs.
--
-- sentry_file is the SSFN-style device-auth blob SteamCMD writes after a
-- successful Steam Guard challenge. Storing it lets subsequent logins skip
-- the 2FA prompt. NULL until first successful login.

CREATE TABLE IF NOT EXISTS steam_credentials (
    id                   SERIAL PRIMARY KEY,
    username             TEXT        NOT NULL UNIQUE,
    password_ciphertext  BYTEA       NOT NULL,
    password_nonce       BYTEA       NOT NULL,
    sentry_file          BYTEA,              -- SSFN device-auth blob, filled after successful login
    last_used_at         TIMESTAMPTZ,
    created_at           TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    updated_at           TIMESTAMPTZ NOT NULL DEFAULT NOW()
);