-- Migration: mail_connection_auth_method
-- Adds OAuth2 token storage fields to mail_connections.
-- Enables generic auth-method framework: 'app_password' (existing) | 'oauth2_microsoft' (new) | future providers.
--
-- Breaking-change status: NONE.
-- All existing rows receive auth_method='app_password' via DEFAULT.
-- OAuth columns are nullable — existing Gmail/iCloud/GMX/Yahoo connections unaffected.
--
-- Deploy: pnpm prisma migrate deploy (on server via GitHub Actions pipeline)

ALTER TABLE "rebreak"."mail_connections"
  ADD COLUMN "auth_method"         TEXT        NOT NULL DEFAULT 'app_password',
  ADD COLUMN "oauth_access_token"  TEXT,
  ADD COLUMN "oauth_refresh_token" TEXT,
  ADD COLUMN "oauth_token_expiry"  TIMESTAMPTZ,
  ADD COLUMN "oauth_scope"         TEXT;

-- Explicit backfill: belt-and-suspenders in case DEFAULT did not apply
-- (should be a no-op since DEFAULT covers all rows at ALTER time, but documents intent).
UPDATE "rebreak"."mail_connections"
   SET "auth_method" = 'app_password'
 WHERE "auth_method" IS NULL OR "auth_method" = '';

-- No index on oauth_token_expiry:
-- Daemon checks expiry on-connect (O(1) per connection record already in memory),
-- not via a scheduled batch query. Index would be unused overhead.
-- Revisit if a background sweep query is introduced.
