ALTER TABLE gateway.identity_providers
    DROP CONSTRAINT IF EXISTS identity_providers_kind_check;

ALTER TABLE gateway.identity_providers
    ADD CONSTRAINT identity_providers_kind_check
        CHECK (kind IN ('oidc', 'saml')),
    ALTER COLUMN issuer_url DROP NOT NULL,
    ALTER COLUMN client_id DROP NOT NULL,
    ALTER COLUMN encrypted_credentials DROP NOT NULL,
    ALTER COLUMN credential_kek_version DROP NOT NULL,
    ALTER COLUMN redirect_uri DROP NOT NULL,
    ADD COLUMN IF NOT EXISTS config jsonb NOT NULL DEFAULT '{}'::jsonb;

COMMENT ON COLUMN gateway.identity_providers.config IS
    'Kind-specific non-secret settings. SAML metadata URL, SP entity ID, ACS URL and attribute names live here.';