-- Audit 2026-07-11 (LOW C1): admin sessions had only a SLIDING expiry, so a
-- continuously-used (or stolen-but-warm) admin token never self-expired. The
-- data-plane app-user sessions (0027) already carry an absolute hard cap; give
-- the higher-privilege admin session the same. `touch` clamps the sliding bump
-- at this value, and `lookup` filters it, so an admin session dies at the later
-- of its idle window or this absolute ceiling — whichever comes first.
ALTER TABLE admin_sessions ADD COLUMN absolute_expires_at TIMESTAMPTZ;

-- Backfill live rows: cap them 30 days from creation (the new default absolute
-- TTL). A row already older than that will be swept on its next lookup.
UPDATE admin_sessions
   SET absolute_expires_at = created_at + INTERVAL '30 days'
 WHERE absolute_expires_at IS NULL;

ALTER TABLE admin_sessions ALTER COLUMN absolute_expires_at SET NOT NULL;

-- Backs the absolute-expiry filter on lookup / prune.
CREATE INDEX admin_sessions_absolute_expiry_idx
    ON admin_sessions (absolute_expires_at);
