"""Add SSVC Technical Impact + Automatable columns to vulnerabilities

Revision ID: 013
Revises: 012
Create Date: 2026-05-17 12:00:00.000000

Adds the two SSVC decision points that were previously parsed but
discarded by the override service:

- ``ssvc_technical_impact`` — ``partial`` | ``total``
- ``ssvc_automatable``      — ``yes`` | ``no``

Background: CISA Vulnrichment scores every CVE on three SSVC
dimensions — Exploitation (already stored as
``exploitation_status``), Technical Impact and Automatable. Tester
asked us to surface the latter two so the operator can prioritise
"total + automatable + active" CVEs (i.e. mass-exploitable, full
takeover) over "partial + no + none".

Both columns are nullable + idempotent so the migration is safe to
re-run against an already-touched schema.
"""
from typing import Sequence, Union

from alembic import op
import sqlalchemy as sa


revision = '013'
down_revision = '012'
branch_labels = None
depends_on = None


def upgrade() -> None:
    op.execute(
        "ALTER TABLE vulnerabilities "
        "ADD COLUMN IF NOT EXISTS ssvc_technical_impact VARCHAR(16)"
    )
    op.execute(
        "ALTER TABLE vulnerabilities "
        "ADD COLUMN IF NOT EXISTS ssvc_automatable VARCHAR(8)"
    )
    op.execute(
        "CREATE INDEX IF NOT EXISTS ix_vulnerabilities_ssvc_technical_impact "
        "ON vulnerabilities (ssvc_technical_impact)"
    )
    op.execute(
        "CREATE INDEX IF NOT EXISTS ix_vulnerabilities_ssvc_automatable "
        "ON vulnerabilities (ssvc_automatable)"
    )


def downgrade() -> None:
    op.execute("DROP INDEX IF EXISTS ix_vulnerabilities_ssvc_automatable")
    op.execute("DROP INDEX IF EXISTS ix_vulnerabilities_ssvc_technical_impact")
    op.execute("ALTER TABLE vulnerabilities DROP COLUMN IF EXISTS ssvc_automatable")
    op.execute("ALTER TABLE vulnerabilities DROP COLUMN IF EXISTS ssvc_technical_impact")
