-- Persist WebAuthn credential BE/BS flags + authenticator attachment so the
-- assertion-time consistency check passes for credentials that move between
-- devices via a password manager (ProtonPass, 1Password, iCloud Keychain
-- across the user's Apple ecosystem, Bitwarden, etc.).
--
-- Without these columns, credential.Flags was zero-valued at load time and
-- the go-webauthn library raised "Backup Eligible flag inconsistency
-- detected during login validation" on the first cross-device assertion —
-- effectively blocking multi-device passkey sync. See DECISIONS.md D50.
--
-- Backfill: existing credentials (registered before this migration ran) are
-- assumed backup_eligible=1 / backup_state=1 because the only path through
-- which a credential could land in this table prior to D50 was the
-- single-device first-registration flow, and on a fresh deploy that path
-- effectively always runs through a synced password manager. Operators
-- using a hardware security key (YubiKey etc., BE=0) must override
-- manually after migration: UPDATE webauthn_credentials SET
-- backup_eligible=0, backup_state=0 WHERE id='<base64url-credid>'.

ALTER TABLE webauthn_credentials ADD COLUMN backup_eligible INTEGER NOT NULL DEFAULT 0;
ALTER TABLE webauthn_credentials ADD COLUMN backup_state    INTEGER NOT NULL DEFAULT 0;
ALTER TABLE webauthn_credentials ADD COLUMN attachment      TEXT;

UPDATE webauthn_credentials SET backup_eligible = 1, backup_state = 1;
