With a single sha256 of the code, and no salt (since the code is already crypto.randomBytes(), what good is another random salt), I can do `SELECT * FROM codes WHERE code=SHA256(code)`.

Ah yes, expiring! I should add a created_at column for code and token (some apps have tokens expire after a year, etc, while being refreshed when a user uses the app again).