erDiagram
      sources {
          string name PK
          string type
          datetime last_seen
          string seen_by
          boolean errored
          string url
          text ca_cert
          string username
          string password
          string project_name "OpenStack only"
          string user_domain_id "OpenStack only"
          string project_domain_id "OpenStack only"
          boolean deleted
      }

      sources ||--o{ consoles : "sources provide consoles"
      consoles {
          string uuid PK
          string source FK
          datetime discovered
          string hypervisor
          string hypervisor_ip
          integer insecure_port
          integer secure_port
          string name
          string host_subject
          string ticket
      }

      sources ||--o{ consoletokens: "sources enable consoletokens"
      consoles ||--o{ consoletokens: "consoles own consoletokens"
      consoletokens {
          string token PK
          string session_id
          string uuid FK
          string source FK
          integer created "epoch seconds"
          integer expires "epoch seconds"
      }

      consoletokens ||--o{ proxychannels: "consoletokens authenticate proxychannels"
      proxychannels {
          string node PK
          string pid PK
          datetime created
          string client_ip
          integer client_port
          integer connection_id
          string channel_type
          integer channel_id
          string session_id "No FK; dropped in migration f7b2e9c4a1d8"
      }

      consoles ||--o{ auditevents: "consoles create auditevents"
      auditevents {
          string source PK "No FK to avoid cascading delete"
          string uuid PK "No FK to avoid cascading delete"
          string session_id "No FK to avoid cascading delete"
          string channel
          datetime timestamp PK "microsecond precision"
          string node
          string pid
          text message
      }

      sf_token_jtis {
          string jti PK "uuid4 hex, from the token's jti claim"
          float expiry "epoch seconds, matches the exp claim"
      }

      sources ||--o{ sf_token_keys: "No FK; sources reloaded from YAML"
      sf_token_keys {
          string source PK "No FK; sources reloaded from YAML"
          text keys_json "Shaken Fist's public_view payload, verbatim JSON"
          float fetched_at "epoch seconds"
      }