"""Add VULNERABILITY_DETECTED audit event type

Revision ID: 031
Revises: 030
Create Date: 2026-06-09 10:00:00.000000

Tester: a CVE newly created by a Wazuh/Nessus sync appeared in the vuln
list but had NO initial audit event ("new CVE detected on asset X") — the
audit trail started with the first status change. Not revisionssicher.

This adds the enum value; the sync paths now write one
VULNERABILITY_DETECTED event per newly created finding.

ALTER TYPE ... ADD VALUE cannot run inside a transaction block on older
Postgres; alembic's autocommit_block handles that.
Idempotent — IF NOT EXISTS.
"""
from alembic import op


revision = "031"
down_revision = "030"
branch_labels = None
depends_on = None


def upgrade() -> None:
    with op.get_context().autocommit_block():
        op.execute(
            "ALTER TYPE auditeventtype ADD VALUE IF NOT EXISTS 'VULNERABILITY_DETECTED'"
        )


def downgrade() -> None:
    # Postgres cannot remove enum values; harmless to leave in place.
    pass
