CREATE TABLE webauthn_challenges (
    id UUID PRIMARY KEY,
    user_id UUID REFERENCES users(id) ON DELETE CASCADE,
    purpose TEXT NOT NULL,
    challenge BYTEA NOT NULL,
    state BYTEA NOT NULL,
    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    expires_at TIMESTAMPTZ NOT NULL,
    CONSTRAINT webauthn_challenges_purpose_check CHECK (purpose IN ('registration', 'authentication'))
);

CREATE INDEX webauthn_challenges_user_id_idx ON webauthn_challenges (user_id);
CREATE INDEX webauthn_challenges_expires_at_idx ON webauthn_challenges (expires_at);