"""Users keep the auth source they came from

Revision ID: 0027_user_auth_source
Revises: 0026_api_tokens
Create Date: 2026-10-06
"""
from typing import Sequence, Union
from alembic import op
import sqlalchemy as sa

revision: str = "0027_user_auth_source"
down_revision: Union[str, None] = "0026_api_tokens"
branch_labels: Union[str, Sequence[str], None] = None
depends_on: Union[str, Sequence[str], None] = None


def upgrade() -> None:
    # Existing rows are local: nothing recorded which provider made them, and
    # an SSO user who finds their name taken is told so at sign-in.
    op.add_column("users", sa.Column("auth_source", sa.String(16), nullable=False,
                                     server_default="local"))
    op.add_column("users", sa.Column("external_id", sa.String(512), nullable=True))
    op.create_unique_constraint("uq_users_auth_source_external_id", "users",
                                ["auth_source", "external_id"])


def downgrade() -> None:
    op.drop_constraint("uq_users_auth_source_external_id", "users", type_="unique")
    op.drop_column("users", "external_id")
    op.drop_column("users", "auth_source")