ALTER TABLE app_users MODIFY COLUMN password_hash VARCHAR(256) NULL;
ALTER TABLE app_users ADD COLUMN IF NOT EXISTS oidc_identity_hash CHAR(64) CHARACTER SET ascii COLLATE ascii_bin NULL;
ALTER TABLE app_users ADD COLUMN IF NOT EXISTS oidc_issuer VARCHAR(512) NULL;
ALTER TABLE app_users ADD COLUMN IF NOT EXISTS oidc_subject VARCHAR(255) NULL;
ALTER TABLE app_users ADD COLUMN IF NOT EXISTS username_display VARCHAR(255) NULL;
CREATE UNIQUE INDEX IF NOT EXISTS users_oidc_identity ON app_users(oidc_identity_hash);
ALTER TABLE auth_sessions ADD COLUMN IF NOT EXISTS auth_provider VARCHAR(10) NOT NULL DEFAULT 'local';
ALTER TABLE auth_sessions ADD COLUMN IF NOT EXISTS encrypted_tokens TEXT NULL;
CREATE TABLE IF NOT EXISTS oidc_settings (
  id TINYINT PRIMARY KEY,
  encrypted_config TEXT NOT NULL,
  updated_by CHAR(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
  updated_at VARCHAR(24) NOT NULL
);
CREATE TABLE IF NOT EXISTS oidc_transactions (
  token_hash CHAR(64) CHARACTER SET ascii COLLATE ascii_bin PRIMARY KEY,
  encrypted_data TEXT NOT NULL,
  expires_at DATETIME(3) NOT NULL
);