"""email_otps — one-time codes for mandatory email verification

Revision ID: 0008
Revises: 0007
Create Date: 2026-05-16
"""
from typing import Sequence, Union

import sqlalchemy as sa
from alembic import op


revision: str = "0008"
down_revision: Union[str, None] = "0007"
branch_labels: Union[str, Sequence[str], None] = None
depends_on: Union[str, Sequence[str], None] = None


def upgrade() -> None:
    op.create_table(
        "email_otps",
        sa.Column("id", sa.BigInteger, primary_key=True, autoincrement=True),
        sa.Column("email", sa.String(255), nullable=False),
        # Argon2 hash of the 6-digit code. Storing the hash means a DB read
        # alone can't recover the code.
        sa.Column("code_hash", sa.String(255), nullable=False),
        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
        sa.Column("attempts", sa.Integer, nullable=False, server_default=sa.text("0")),
        # null = unused. Set when consumed (correct submission) or marked dead
        # (too many attempts / superseded by newer code for same email).
        sa.Column("used_at", sa.DateTime(timezone=True)),
        sa.Column("purpose", sa.String(16), nullable=False, server_default="signup"),
    )
    op.create_index("ix_otps_email_created", "email_otps", ["email", "created_at"])


def downgrade() -> None:
    op.drop_index("ix_otps_email_created", table_name="email_otps")
    op.drop_table("email_otps")