"""add password_version to download_links (invalidate watch grants on password change)

Revision ID: 0059_dl_link_pw_version
Revises: 0058_dl_default_720p
Create Date: 2026-07-23

A password-protected share link mints a short-lived HMAC "grant" at /unlock so the media URL never
carries the password. The grant previously signed only <token>.<exp>, so rotating a link's password
did NOT invalidate outstanding grants — they lived out their 6h TTL. Fold a per-link password_version
into the signed grant and bump it on every password change, so a rotation revokes old grants at once.
Small table (one row per share link), so this is a quick add-column with a default.
"""

from typing import Sequence, Union

import sqlalchemy as sa
from alembic import op

revision: str = "0059_dl_link_pw_version"
down_revision: Union[str, None] = "0058_dl_default_720p"
branch_labels: Union[str, Sequence[str], None] = None
depends_on: Union[str, Sequence[str], None] = None


def upgrade() -> None:
    op.add_column(
        "download_links",
        sa.Column("password_version", sa.Integer(), nullable=False, server_default="0"),
    )


def downgrade() -> None:
    op.drop_column("download_links", "password_version")