-- Add Microsoft Entra sid so front-channel logout can map the IdP session to the app session.
SET @exists := (
  SELECT COUNT(*)
  FROM information_schema.columns
  WHERE table_schema = DATABASE()
    AND table_name = 'user_microsoft_oauth_tokens'
    AND column_name = 'microsoft_session_id'
);

SET @sql := IF(
  @exists = 0,
  'ALTER TABLE user_microsoft_oauth_tokens ADD COLUMN microsoft_session_id VARCHAR(191) NULL AFTER microsoft_subject',
  'SELECT 1'
);

PREPARE stmt FROM @sql;
EXECUTE stmt;
DEALLOCATE PREPARE stmt;

