"""add login_throttle

Wrong passphrases per username, for the per-account sign-in lockout. Keyed by a
hash of the name as typed, so unknown names are counted like real ones.

Revision ID: a9b8c7d6e5f4
Revises: e5f6a7b8c9d0
"""

from collections.abc import Sequence

import sqlalchemy as sa
from alembic import op

revision: str = "a9b8c7d6e5f4"
down_revision: str | Sequence[str] | None = "e5f6a7b8c9d0"
branch_labels: str | Sequence[str] | None = None
depends_on: str | Sequence[str] | None = None


def upgrade() -> None:
    op.create_table(
        "login_throttle",
        sa.Column("key", sa.String(64), primary_key=True),
        sa.Column("failures", sa.Integer(), nullable=False, server_default="0"),
        sa.Column("last_failure_at", sa.DateTime(timezone=True), nullable=False),
    )


def downgrade() -> None:
    # Dropping this forgets every count in progress, which unlocks everyone —
    # the limits themselves live in `hub_settings`.
    op.drop_table("login_throttle")