"""Add cve_remediations table (multi-source enrichment)

Revision ID: 032
Revises: 031
Create Date: 2026-06-10 09:00:00.000000

Tester feature: enrich remediation coverage beyond the Nessus scanner
solution. External primary sources (MSRC CVRF for Windows + MS products,
later Ubuntu USN / CentOS errata for Linux) provide per-CVE fixes (KB +
fixed build + download URL), workarounds, and mitigations/containment for
cases where no patch/KB exists yet.

These are CVE-level (not per-asset-row), so they live in their own table
keyed by cve_id; the existing vulnerabilities.remediation column (the
scanner solution) is unchanged and shown alongside.

Idempotent — CREATE TABLE / INDEX IF NOT EXISTS.
"""
from alembic import op


revision = "032"
down_revision = "031"
branch_labels = None
depends_on = None


def upgrade() -> None:
    op.execute("""
        CREATE TABLE IF NOT EXISTS cve_remediations (
            id          SERIAL PRIMARY KEY,
            cve_id      VARCHAR(50) NOT NULL,
            source      VARCHAR(32) NOT NULL,   -- msrc | ubuntu | centos | ...
            kind        VARCHAR(24) NOT NULL,   -- fix | workaround | mitigation | advisory
            title       VARCHAR(300),
            detail      TEXT,
            kb          VARCHAR(64),
            fixed_build VARCHAR(120),
            url         TEXT,
            fetched_at  TIMESTAMP NOT NULL DEFAULT now()
        );
    """)
    op.execute("CREATE INDEX IF NOT EXISTS ix_cve_remediations_cve_id ON cve_remediations (cve_id);")
    op.execute("CREATE INDEX IF NOT EXISTS ix_cve_remediations_cve_src ON cve_remediations (cve_id, source);")


def downgrade() -> None:
    op.execute("DROP TABLE IF EXISTS cve_remediations;")
