create type account_token_purpose as enum ('invitation', 'password_reset');

create table account_access_tokens (
  id uuid primary key default gen_random_uuid(),
  email text not null,
  role user_role not null default 'student',
  purpose account_token_purpose not null,
  token_hash text not null unique,
  expires_at timestamptz not null,
  used_at timestamptz,
  created_by uuid not null references users(id),
  created_at timestamptz not null default now()
);

create index account_access_tokens_lookup_index on account_access_tokens (token_hash) where used_at is null;