-- OAuth Dynamic Client Registration (RFC 7591).
--
-- Self-registering clients (claude.ai remote connectors, Cursor, Copilot,
-- etc.) have NO human owner — they POST their metadata to /oauth/register and
-- get back a client_id/secret. To allow that, owner_id becomes nullable and a
-- `dynamically_registered` flag distinguishes these apps from human-created
-- ones. Existing rows keep their owner and default to dynamically_registered
-- = false, so nothing about the current developer-apps UI changes.
--
-- Additive + backward-compatible: the only code that reads owner_id filters
-- "apps owned by user X" (developer-apps.tsx); a NULL owner simply never
-- matches, so DCR apps are correctly invisible in any human's app list.

ALTER TABLE oauth_apps
  ALTER COLUMN owner_id DROP NOT NULL;

ALTER TABLE oauth_apps
  ADD COLUMN IF NOT EXISTS dynamically_registered BOOLEAN NOT NULL DEFAULT FALSE;

-- Optional per-RFC-7591 registration management token (hashed). Lets a client
-- later read/update/delete its own registration without a user session.
ALTER TABLE oauth_apps
  ADD COLUMN IF NOT EXISTS registration_access_token_hash TEXT;

CREATE INDEX IF NOT EXISTS idx_oauth_apps_dcr
  ON oauth_apps(dynamically_registered)
  WHERE dynamically_registered = TRUE;