"""Add assets.aad_device_id for cross-source (Intune ↔ Defender) merge

Revision ID: 036
Revises: 035
Create Date: 2026-07-09 10:00:00.000000

The same physical device has different per-service ids (intune_device_id vs
defender_machine_id), so Intune and Defender could only merge by hostname —
which fails when the names differ (e.g. Defender's computerDnsName is the
Intune management name). The Entra/AAD device id is the stable cross-service
anchor (Intune `azureADDeviceId` == Defender `aadDeviceId`); store + match on
it so one physical device is one asset regardless of name/rename.

Idempotent.
"""
from alembic import op


revision = "036"
down_revision = "035"
branch_labels = None
depends_on = None


def upgrade() -> None:
    op.execute("ALTER TABLE assets ADD COLUMN IF NOT EXISTS aad_device_id VARCHAR(64);")
    op.execute("CREATE INDEX IF NOT EXISTS ix_assets_aad_device_id ON assets (aad_device_id);")


def downgrade() -> None:
    op.execute("DROP INDEX IF EXISTS ix_assets_aad_device_id;")
    op.execute("ALTER TABLE assets DROP COLUMN IF EXISTS aad_device_id;")
