SET NAMES utf8mb4;

ALTER TABLE user_oauth_states
  ADD COLUMN client_platform VARCHAR(10) NOT NULL DEFAULT 'h5',
  ADD COLUMN app_proof_hash BINARY(32) NULL;

ALTER TABLE user_oauth_login_codes
  ADD COLUMN client_platform VARCHAR(10) NOT NULL DEFAULT 'h5',
  ADD COLUMN app_proof_hash BINARY(32) NULL,
  ADD COLUMN identity_scope VARCHAR(191) NOT NULL DEFAULT '';

-- OpenID is scoped to the provider's application. Keep existing H5 bindings,
-- and allow a user to bind the mobile application identity independently.
ALTER TABLE user_oauth_identities
  ADD COLUMN identity_scope VARCHAR(191) NOT NULL DEFAULT '',
  DROP INDEX uk_user_oauth_provider_subject,
  DROP INDEX uk_user_oauth_user_provider,
  ADD UNIQUE KEY uk_user_oauth_provider_subject (provider, identity_scope, subject),
  ADD UNIQUE KEY uk_user_oauth_user_provider (user_id, provider, identity_scope);

INSERT INTO system_configs (config_key, config_value, value_type, description) VALUES
  ('oauth.app.frontend_callback_url', 'xingyuim://oauth/callback', 'string', 'App GitHub 授权结果地址，必须与打包的 URL Scheme 一致'),
  ('oauth.app.wechat.enabled', 'false', 'boolean', '在 App 启用微信原生登录'),
  ('oauth.app.qq.enabled', 'false', 'boolean', '在 App 启用 QQ 原生登录'),
  ('oauth.app.github.enabled', 'false', 'boolean', '在 App 启用 GitHub 系统浏览器登录'),
  ('oauth.app.google.enabled', 'false', 'boolean', '在 App 启用 Google 原生登录'),
  ('oauth.app.wechat.client_id', '', 'string', '微信开放平台移动应用 AppID'),
  ('oauth.app.wechat.client_secret', '', 'secret', '微信移动应用 AppSecret，仅服务端保存'),
  ('oauth.app.qq.client_id', '', 'string', 'QQ 互联移动应用 AppID'),
  ('oauth.app.google.client_ids', '', 'string', '允许的 Google Android/iOS OAuth Client ID，以英文逗号分隔')
ON DUPLICATE KEY UPDATE description = VALUES(description);