"""Add app_cve_cache for the built-in app→CVE scanner

Revision ID: 035
Revises: 034
Create Date: 2026-06-19 09:00:00.000000

Caches (product, version) → CVE lookups from OSV / NVD-CPE so the built-in
scanner doesn't re-query the same Chrome/Firefox/... version for every host
(and stays under NVD's rate limit). CVE↔version is stable; refreshed on a
TTL.

Idempotent.
"""
from alembic import op


revision = "035"
down_revision = "034"
branch_labels = None
depends_on = None


def upgrade() -> None:
    op.execute("""
        CREATE TABLE IF NOT EXISTS app_cve_cache (
            id          SERIAL PRIMARY KEY,
            product_key VARCHAR(160) NOT NULL,   -- cpe:a:google:chrome | osv:npm:lodash
            version     VARCHAR(120) NOT NULL,
            cves        TEXT,                     -- JSON [{cve,cvss,severity,fixed}]
            fetched_at  TIMESTAMP NOT NULL DEFAULT now()
        );
    """)
    op.execute("""
        CREATE UNIQUE INDEX IF NOT EXISTS uq_app_cve_cache_key_ver
            ON app_cve_cache (product_key, version);
    """)


def downgrade() -> None:
    op.execute("DROP TABLE IF EXISTS app_cve_cache;")
