-- Stores which Beezifi identity is explicitly linked to each GRC user account.
-- NULL means no Beezifi account has been linked yet — Beezifi login will be refused.
ALTER TABLE users
  ADD COLUMN beezifi_sub VARCHAR(255) DEFAULT NULL AFTER password_hash,
  ADD UNIQUE INDEX idx_users_beezifi_sub (beezifi_sub);

-- Allow the oauth state table to carry the initiating user when the flow is 'link'
-- (as opposed to 'login' where no authenticated user exists yet).
ALTER TABLE beezifi_oauth_states
  ADD COLUMN flow    VARCHAR(10)  NOT NULL DEFAULT 'login' AFTER nonce,
  ADD COLUMN user_id VARCHAR(36)  DEFAULT NULL             AFTER flow;
