"""add source location hourly snapshots

Revision ID: 20260710_02
Revises: 20260710_01
Create Date: 2026-07-10 15:30:00.000000
"""

from typing import Sequence, Union

import sqlalchemy as sa
from alembic import op


revision: str = "20260710_02"
down_revision: Union[str, None] = "20260710_01"
branch_labels: Union[str, Sequence[str], None] = None
depends_on: Union[str, Sequence[str], None] = None


def upgrade() -> None:
    op.create_table(
        "source_location_snapshots",
        sa.Column("id", sa.Uuid(), nullable=False),
        sa.Column("bucket_time", sa.DateTime(timezone=True), nullable=False),
        sa.Column("ip_hash", sa.String(length=64), nullable=False),
        sa.Column("user_hash", sa.String(length=64), nullable=False, server_default=""),
        sa.Column("country", sa.String(length=100), nullable=False, server_default=""),
        sa.Column("country_code", sa.String(length=16), nullable=False, server_default=""),
        sa.Column("province", sa.String(length=100), nullable=False, server_default=""),
        sa.Column("region_code", sa.String(length=24), nullable=False, server_default=""),
        sa.Column("city", sa.String(length=100), nullable=False, server_default=""),
        sa.Column("isp", sa.String(length=160), nullable=False, server_default=""),
        sa.Column("location", sa.String(length=320), nullable=False, server_default=""),
        sa.Column("longitude", sa.Float(), nullable=True),
        sa.Column("latitude", sa.Float(), nullable=True),
        sa.Column("accuracy_level", sa.String(length=16), nullable=False, server_default="unknown"),
        sa.Column("allowed_count", sa.Integer(), nullable=False, server_default="0"),
        sa.Column("denied_count", sa.Integer(), nullable=False, server_default="0"),
        sa.Column("security_event_count", sa.Integer(), nullable=False, server_default="0"),
        sa.Column("high_risk_count", sa.Integer(), nullable=False, server_default="0"),
        sa.Column("auth_failure_count", sa.Integer(), nullable=False, server_default="0"),
        sa.Column("first_seen_at", sa.DateTime(timezone=True), nullable=False),
        sa.Column("last_seen_at", sa.DateTime(timezone=True), nullable=False),
        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
        sa.PrimaryKeyConstraint("id"),
        sa.UniqueConstraint("bucket_time", "ip_hash", "user_hash", name="uq_source_location_bucket_identity"),
    )
    op.create_index("ix_source_location_bucket", "source_location_snapshots", ["bucket_time"])
    op.create_index(
        "ix_source_location_country_bucket",
        "source_location_snapshots",
        ["country_code", "bucket_time"],
    )
    op.create_index(
        "ix_source_location_risk_bucket",
        "source_location_snapshots",
        ["high_risk_count", "bucket_time"],
    )

    op.execute(
        """
        UPDATE security_access_logs
        SET category = CASE
                WHEN lower(path) LIKE '%/.env%' OR lower(path) LIKE '%.git%'
                    OR lower(path) LIKE '%backup%' OR lower(path) LIKE '%config.php%'
                    OR lower(path) LIKE '%wp-config%' OR lower(path) LIKE '%database.yml%'
                    THEN 'PROBE'
                WHEN status_code >= 500 THEN 'SERVER_ERROR'
                WHEN auth_status = 'INVALID_TOKEN' THEN 'INVALID_TOKEN'
                WHEN auth_status = 'ANONYMOUS' AND status_code IN (401, 403) THEN 'ANONYMOUS_API'
                WHEN status_code = 404 THEN 'NOT_FOUND_NOISE'
                ELSE 'OTHER'
            END,
            severity = CASE
                WHEN lower(path) LIKE '%/.env%' OR lower(path) LIKE '%.git%'
                    OR lower(path) LIKE '%backup%' OR lower(path) LIKE '%config.php%'
                    OR lower(path) LIKE '%wp-config%' OR lower(path) LIKE '%database.yml%'
                    THEN 'CRITICAL'
                WHEN status_code >= 500 THEN 'HIGH'
                WHEN auth_status = 'INVALID_TOKEN' THEN 'MEDIUM'
                WHEN auth_status = 'ANONYMOUS' AND status_code IN (401, 403) THEN 'MEDIUM'
                ELSE 'LOW'
            END
        WHERE category = 'ABNORMAL_IP'
        """
    )


def downgrade() -> None:
    op.drop_index("ix_source_location_risk_bucket", table_name="source_location_snapshots")
    op.drop_index("ix_source_location_country_bucket", table_name="source_location_snapshots")
    op.drop_index("ix_source_location_bucket", table_name="source_location_snapshots")
    op.drop_table("source_location_snapshots")