1CREATE TABLE ssh_keys (
 2    id TEXT PRIMARY KEY CHECK (length(id) = 36),
 3    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
 4    fingerprint TEXT NOT NULL UNIQUE
 5        CHECK (
 6            length(fingerprint) = 50
 7            AND substr(fingerprint, 1, 7) = 'SHA256:'
 8            AND substr(fingerprint, 8) NOT GLOB '*[^A-Za-z0-9+/]*'
 9        ),
10    key_type TEXT NOT NULL
11        CHECK (key_type IN (
12            'ssh-ed25519',
13            'ecdsa-sha2-nistp256',
14            'ecdsa-sha2-nistp384',
15            'ecdsa-sha2-nistp521',
16            'ssh-rsa',
17            'sk-ssh-ed25519@openssh.com',
18            'sk-ecdsa-sha2-nistp256@openssh.com'
19        )),
20    key_data BLOB NOT NULL CHECK (length(key_data) > 0),
21    label TEXT NOT NULL CHECK (length(CAST(label AS BLOB)) <= 128),
22    added_at INTEGER NOT NULL
23) STRICT;
24
25CREATE INDEX ssh_keys_user_id_idx ON ssh_keys(user_id, added_at, id);