"""add_key_rotated_audit_event

Revision ID: 3a3d5a864c79
Revises: 670c53d0a29e
Create Date: 2026-06-03 11:04:59.589435
"""
from typing import Sequence, Union

from alembic import op
import sqlalchemy as sa


# ---------------------------------------------------------------------------
# Revision identifiers — used by Alembic
# ---------------------------------------------------------------------------
revision: str = '3a3d5a864c79'
down_revision: Union[str, None] = '670c53d0a29e'
branch_labels: Union[str, Sequence[str], None] = None
depends_on: Union[str, Sequence[str], None] = None


def upgrade() -> None:
    op.execute("ALTER TABLE auth_audit_log DROP CONSTRAINT IF EXISTS ck_audit_event_type_valid")
    op.execute(
        """
        ALTER TABLE auth_audit_log
        ADD CONSTRAINT ck_audit_event_type_valid CHECK (
            event_type IN (
                'login_success', 'login_failure', 'token_refresh', 'token_refresh_failure',
                'logout', 'key_revoked', 'replay_attack', 'invalid_signature',
                'scope_denied', 'account_locked', 'job_run',
                'key_secret_revealed', 'key_rotated'
            )
        )
        """
    )


def downgrade() -> None:
    op.execute("ALTER TABLE auth_audit_log DROP CONSTRAINT IF EXISTS ck_audit_event_type_valid")
    op.execute(
        """
        ALTER TABLE auth_audit_log
        ADD CONSTRAINT ck_audit_event_type_valid CHECK (
            event_type IN (
                'login_success', 'login_failure', 'token_refresh', 'token_refresh_failure',
                'logout', 'key_revoked', 'replay_attack', 'invalid_signature',
                'scope_denied', 'account_locked', 'job_run', 'key_secret_revealed'
            )
        )
        """
    )