-- Microsoft app-only auth mode (client credentials, equivalent to Google DWD)
ALTER TABLE migration_projects DROP CONSTRAINT IF EXISTS migration_projects_auth_mode_check;

ALTER TABLE migration_projects
    ADD CONSTRAINT migration_projects_auth_mode_check
    CHECK (auth_mode IN ('oauth', 'google_dwd', 'microsoft_app'));