-- Add IP allowlisting support to API keys
-- Allows restricting API key usage to specific IP addresses/CIDR ranges

-- Add allowed_ips column to api_keys table
-- Using TEXT[] to store CIDR notation strings (e.g., "192.168.1.0/24", "10.0.0.0/8")
-- NULL means no IP restriction (allow from anywhere)
ALTER TABLE api_keys ADD COLUMN IF NOT EXISTS allowed_ips TEXT[];

COMMENT ON COLUMN api_keys.allowed_ips IS 'Array of allowed IP addresses/CIDR ranges. NULL = no restriction (allow from anywhere)';