-- name: GetUserByOIDCSubject :one
SELECT * FROM core.users
WHERE oidc_subject = $1;

-- name: CreateUser :one
INSERT INTO core.users (oidc_subject)
VALUES ($1)
RETURNING *;

-- name: UpdateUserLogin :one
UPDATE core.users
SET last_login_at = $1, last_login_ip = $2
WHERE user_id = $3
RETURNING *;

-- name: EnsureSystemUser :exec
-- Idempotently insert the reserved, non-loginable system user (keyed on the
-- unique oidc_subject sentinel). Safe under concurrent boots; read back with
-- GetUserByOIDCSubject.
INSERT INTO core.users (oidc_subject)
VALUES ($1)
ON CONFLICT (oidc_subject) DO NOTHING;