CREATE TABLE IF NOT EXISTS user_microsoft_oauth_tokens (
  id BINARY(16) NOT NULL,
  user_id BINARY(16) NOT NULL,
  provider VARCHAR(32) NOT NULL,
  tenant_id VARCHAR(128) NOT NULL,
  microsoft_object_id VARCHAR(191) NOT NULL,
  microsoft_subject VARCHAR(191) NOT NULL,
  refresh_token_encrypted BLOB NOT NULL,
  access_token_encrypted BLOB NULL,
  id_token_encrypted BLOB NULL,
  scope TEXT NULL,
  token_type VARCHAR(32) NULL,
  access_token_expires_at DATETIME(3) NULL,
  refresh_token_rotated_at DATETIME(3) NULL,
  created_at DATETIME(3) NULL,
  created_by BINARY(16) NULL,
  updated_at DATETIME(3) NULL,
  updated_by BINARY(16) NULL,
  PRIMARY KEY (id),
  UNIQUE KEY ux_user_ms_oauth_user_provider (user_id, provider),
  KEY idx_user_ms_oauth_tenant_id (tenant_id),
  CONSTRAINT fk_user_ms_oauth_user FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE ON UPDATE CASCADE
);