"""add_detection_rules_table

Revision ID: b009detectionrules
Revises: b008datasources
Create Date: 2026-02-09 14:10:00.000000

"""
from typing import Sequence, Union

from alembic import op
import sqlalchemy as sa
from sqlalchemy.dialects.postgresql import UUID, JSONB


# revision identifiers, used by Alembic.
revision: str = 'b009detectionrules'
down_revision: Union[str, Sequence[str], None] = 'b008datasources'
branch_labels: Union[str, Sequence[str], None] = None
depends_on: Union[str, Sequence[str], None] = None


def upgrade() -> None:
    """Create detection_rules table."""
    op.create_table(
        'detection_rules',
        sa.Column('id', UUID(as_uuid=True), primary_key=True),
        sa.Column('mitre_technique_id', sa.String(), nullable=False),
        sa.Column('title', sa.String(), nullable=False),
        sa.Column('description', sa.Text(), nullable=True),
        sa.Column('source', sa.String(), nullable=False),
        sa.Column('source_id', sa.String(), nullable=True),
        sa.Column('source_url', sa.String(), nullable=True),
        sa.Column('rule_content', sa.Text(), nullable=False),
        sa.Column('rule_format', sa.String(), nullable=False),
        sa.Column('severity', sa.String(), nullable=True),
        sa.Column('platforms', JSONB(), nullable=True),
        sa.Column('log_sources', JSONB(), nullable=True),
        sa.Column('false_positive_rate', sa.String(), nullable=True),
        sa.Column('is_active', sa.Boolean(), server_default='true'),
        sa.Column('created_at', sa.DateTime(), server_default=sa.func.now()),
    )
    op.create_index('ix_detection_rules_mitre_technique_id', 'detection_rules', ['mitre_technique_id'])
    op.create_index('ix_detection_rules_source', 'detection_rules', ['source'])
    op.create_index('ix_detection_rules_severity', 'detection_rules', ['severity'])


def downgrade() -> None:
    """Drop detection_rules table."""
    op.drop_index('ix_detection_rules_severity', table_name='detection_rules')
    op.drop_index('ix_detection_rules_source', table_name='detection_rules')
    op.drop_index('ix_detection_rules_mitre_technique_id', table_name='detection_rules')
    op.drop_table('detection_rules')