"""Add NESSUS to AssetSource + ASSET_DEACTIVATED/REACTIVATED audit types

Revision ID: 027
Revises: 026
Create Date: 2026-06-02 00:00:00.000000

Tester feedback round 2026-06-01:
  - Sync-driven reconciliation needs to distinguish Nessus-sourced
    assets from Wazuh-sourced ones, so `AssetSource.NESSUS` is added.
  - Audit log gains ASSET_DEACTIVATED + ASSET_REACTIVATED event types
    so the lifecycle transitions are filterable in the audit UI.

Important: the existing PostgreSQL `assetsource` enum has UPPERCASE
labels ('WAZUH' / 'MANUAL'). The Python AssetSource enum has been
updated to use uppercase values to match. New PG enum value added
here is 'NESSUS' (uppercase) for consistency.

Important: PG requires a new enum value to be COMMITTED before it can
be used in the same session. A data UPDATE that references the new
value in the same transaction as the ALTER TYPE fails with
`unsafe use of new value ... of enum type`. Therefore this migration
ONLY extends the enums — the runtime backfill of MANUAL -> NESSUS for
assets that have a pinned nessus_host_uuid is performed lazily in
`app/services/asset_lifecycle.reconcile_missing_from_sync()` (called
on every Nessus sync), which runs in a later transaction.
"""
from alembic import op


revision = "027"
down_revision = "026"
branch_labels = None
depends_on = None


def upgrade() -> None:
    op.execute("ALTER TYPE assetsource ADD VALUE IF NOT EXISTS 'NESSUS'")
    op.execute("ALTER TYPE auditeventtype ADD VALUE IF NOT EXISTS 'ASSET_DEACTIVATED'")
    op.execute("ALTER TYPE auditeventtype ADD VALUE IF NOT EXISTS 'ASSET_REACTIVATED'")


def downgrade() -> None:
    # PG cannot DROP VALUE on an enum. No-op.
    pass
