"""Add network-exposure columns to assets

Revision ID: 026
Revises: 025
Create Date: 2026-05-31 16:00:00.000000

Tester request: use Wazuh IT-hygiene (open listeners / ports) as an
extra risk dimension — a host with an exposed VNC/RDP/Telnet listener
is network-vulnerabler regardless of its CVE count.

Columns on `assets`:
  network_exposure_score  FLOAT  0-100, computed from risky listeners
  exposed_services        TEXT   JSON list of {port, proto, service, risk}
  exposure_updated_at     TIMESTAMP

Idempotent — ADD COLUMN IF NOT EXISTS.
"""
from alembic import op


revision = "026"
down_revision = "025"
branch_labels = None
depends_on = None


def upgrade() -> None:
    op.execute("""
        ALTER TABLE assets
            ADD COLUMN IF NOT EXISTS network_exposure_score DOUBLE PRECISION,
            ADD COLUMN IF NOT EXISTS exposed_services       TEXT,
            ADD COLUMN IF NOT EXISTS exposure_updated_at    TIMESTAMP;
    """)
    op.execute("""
        CREATE INDEX IF NOT EXISTS ix_assets_network_exposure_score
            ON assets (network_exposure_score)
            WHERE network_exposure_score > 0;
    """)


def downgrade() -> None:
    op.execute("DROP INDEX IF EXISTS ix_assets_network_exposure_score;")
    op.execute("""
        ALTER TABLE assets
            DROP COLUMN IF EXISTS network_exposure_score,
            DROP COLUMN IF EXISTS exposed_services,
            DROP COLUMN IF EXISTS exposure_updated_at;
    """)
