"""Add exploitation_status (SSVC) column for vulnerability prioritization

Revision ID: 012
Revises: 011
Create Date: 2026-05-14 17:45:00.000000

Adds ``vulnerabilities.exploitation_status`` — SSVC Exploitation field per
NIST SP 500-299 Draft (v2.0, 2024-05). Used by CISA Vulnrichment and
Nessus to indicate whether active exploitation is observed.

Values: none, poc, active, widespread

This field complements:
- ``exploit_available`` (boolean, exists)
- ``exploit_maturity`` (Nessus category, exists)

SSVC provides a richer status than "exploit_available" alone:
- none: No known exploitation activity
- poc: Proof-of-concept exists but no active exploitation
- active: Active exploitation in the wild
- widespread: Widespread exploitation (mass exploitation campaigns)

Idempotent — survives if column already exists.
"""
from typing import Sequence, Union

from alembic import op
import sqlalchemy as sa


revision = '012'
down_revision = '011'
branch_labels = None
depends_on = None


def upgrade() -> None:
    # Add exploitation_status column with default
    op.execute(
        """
        ALTER TABLE vulnerabilities
        ADD COLUMN IF NOT EXISTS exploitation_status VARCHAR(20)
        DEFAULT 'none'
        """
    )
    # Add index for filtering by exploitation status
    op.execute(
        """
        CREATE INDEX IF NOT EXISTS ix_vulnerabilities_exploitation_status
        ON vulnerabilities (exploitation_status)
        """
    )
    
    # Add exploitation_source to track where the status came from
    op.execute(
        """
        ALTER TABLE vulnerabilities
        ADD COLUMN IF NOT EXISTS exploitation_source VARCHAR(20)
        """
    )
    op.execute(
        """
        CREATE INDEX IF NOT EXISTS ix_vulnerabilities_exploitation_source
        ON vulnerabilities (exploitation_source)
        """
    )


def downgrade() -> None:
    op.execute("DROP INDEX IF EXISTS ix_vulnerabilities_exploitation_status")
    op.execute("DROP INDEX IF EXISTS ix_vulnerabilities_exploitation_source")
    op.execute("ALTER TABLE vulnerabilities DROP COLUMN IF EXISTS exploitation_status")
    op.execute("ALTER TABLE vulnerabilities DROP COLUMN IF EXISTS exploitation_source")