ALTER TABLE IF EXISTS mfa_challenges
  ADD COLUMN IF NOT EXISTS purpose TEXT NOT NULL DEFAULT 'login',
  ADD COLUMN IF NOT EXISTS pending_secret_encrypted TEXT,
  ADD COLUMN IF NOT EXISTS pending_recovery_code_hashes JSONB NOT NULL DEFAULT '[]'::jsonb;