"""add_key_secret_revealed_audit_event

Revision ID: 670c53d0a29e
Revises: 0001
Create Date: 2026-06-03 10:53:31.020513
"""
from typing import Sequence, Union

from alembic import op
import sqlalchemy as sa


# ---------------------------------------------------------------------------
# Revision identifiers — used by Alembic
# ---------------------------------------------------------------------------
revision: str = '670c53d0a29e'
down_revision: Union[str, None] = '0001'
branch_labels: Union[str, Sequence[str], None] = None
depends_on: Union[str, Sequence[str], None] = None


def upgrade() -> None:
    # Drop the old check constraint and replace it with one that includes
    # the new 'key_secret_revealed' event type.
    op.execute("ALTER TABLE auth_audit_log DROP CONSTRAINT IF EXISTS ck_audit_event_type_valid")
    op.execute(
        """
        ALTER TABLE auth_audit_log
        ADD CONSTRAINT ck_audit_event_type_valid CHECK (
            event_type IN (
                'login_success', 'login_failure', 'token_refresh', 'token_refresh_failure',
                'logout', 'key_revoked', 'replay_attack', 'invalid_signature',
                'scope_denied', 'account_locked', 'job_run', 'key_secret_revealed'
            )
        )
        """
    )


def downgrade() -> None:
    op.execute("ALTER TABLE auth_audit_log DROP CONSTRAINT IF EXISTS ck_audit_event_type_valid")
    op.execute(
        """
        ALTER TABLE auth_audit_log
        ADD CONSTRAINT ck_audit_event_type_valid CHECK (
            event_type IN (
                'login_success', 'login_failure', 'token_refresh', 'token_refresh_failure',
                'logout', 'key_revoked', 'replay_attack', 'invalid_signature',
                'scope_denied', 'account_locked', 'job_run'
            )
        )
        """
    )