-- MySQL-compatible MFA table
CREATE TABLE IF NOT EXISTS user_mfa (
  id BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
  user_id BIGINT UNSIGNED NOT NULL,
  secret_enc VARBINARY(512) NOT NULL,
  secret_iv VARBINARY(128) NOT NULL,
  secret_tag VARBINARY(128) NOT NULL,
  kdf_salt VARBINARY(128) NOT NULL,
  enabled TINYINT(1) NOT NULL DEFAULT 0,
  last_verified_at DATETIME NULL,
  created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
  updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  UNIQUE KEY idx_user_mfa_user (user_id),
  FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;