-- 021_key_decrypted_at.sql
-- Adds precise decryption timestamps for both sender and recipient 5-min key flows.
-- Previously only a boolean (sender_key_decrypted / recipient_key_decrypted) was tracked.

ALTER TABLE customers
  ADD COLUMN IF NOT EXISTS sender_key_decrypted_at TIMESTAMP WITH TIME ZONE,
  ADD COLUMN IF NOT EXISTS recipient_key_decrypted_at TIMESTAMP WITH TIME ZONE;

COMMENT ON COLUMN customers.sender_key_decrypted_at IS 'When sender successfully decrypted via 5-min key (decrypt.html). NULL if not yet decrypted via Stargate.';
COMMENT ON COLUMN customers.recipient_key_decrypted_at IS 'When recipient successfully decrypted via 5-min key (decrypt.html). NULL if not yet decrypted via Stargate.';
