-- Adds storage for WebAuthn passkey credentials
CREATE TABLE IF NOT EXISTS user_mfa_webauthn (
    factor_id     uuid PRIMARY KEY REFERENCES user_mfa_factors(factor_id) ON DELETE CASCADE,
    credential_id text NOT NULL,
    public_key    text NOT NULL,
    sign_count    bigint NOT NULL DEFAULT 0,
    transports    jsonb,
    last_counter  bigint,
    aaguid        uuid
);

-- Backfill enum (no-op if value already present)
DO $$
BEGIN
    IF NOT EXISTS (
        SELECT 1 FROM pg_type t
        JOIN pg_enum e ON t.oid = e.enumtypid
        WHERE t.typname = 'mfa_type' AND e.enumlabel = 'webauthn'
    ) THEN
        ALTER TYPE mfa_type ADD VALUE 'webauthn';
    END IF;
END $$;
