/** Security audit log. */

/** @param {import('node-pg-migrate').MigrationBuilder} pgm */
export const up = (pgm) => {
  pgm.sql(`
    CREATE TABLE security_audit_log (
      id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
      actor_id uuid,
      action text NOT NULL,
      target text NOT NULL,
      metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
      created_at timestamptz NOT NULL DEFAULT now()
    )
  `);
  pgm.sql('CREATE INDEX security_audit_log_actor_id_idx ON security_audit_log (actor_id)');
  pgm.sql('CREATE INDEX security_audit_log_action_idx ON security_audit_log (action)');

  pgm.sql(`
    ALTER TABLE identity_users
      ADD COLUMN mfa_enrolled boolean NOT NULL DEFAULT false
  `);
};

/** @param {import('node-pg-migrate').MigrationBuilder} pgm */
export const down = (pgm) => {
  pgm.sql('ALTER TABLE identity_users DROP COLUMN IF EXISTS mfa_enrolled');
  pgm.sql('DROP TABLE IF EXISTS security_audit_log');
};