import type { Kysely } from "kysely";
import { sql } from "kysely";

/**
 * Per-token CORS opt-in for browser callers.
 *
 * `cors = 1` lets responses to requests authenticated by THIS token carry
 * `Access-Control-Allow-Origin: <request origin>` (see middleware/cors.ts).
 * Same-origin policy exists to protect ambient credentials (cookies); a
 * deliberately attached Bearer token is not ambient, so cross-origin browser
 * use is safe to grant — but only by explicit opt-in, per token.
 *
 * Guarded against re-run (the #954 partial-apply failure mode): ALTER TABLE
 * ADD COLUMN has no IF NOT EXISTS, so probe the schema first.
 */
export async function up(db: Kysely<unknown>): Promise<void> {
	const info = await sql<{ name: string }>`PRAGMA table_info(_emdash_api_tokens)`.execute(db);
	if (!info.rows.some((r) => r.name === "cors")) {
		await sql`ALTER TABLE _emdash_api_tokens ADD COLUMN cors INTEGER NOT NULL DEFAULT 0`.execute(
			db,
		);
	}
}

export async function down(_db: Kysely<unknown>): Promise<void> {
	// SQLite DROP COLUMN support varies by version; the column is inert when
	// unused, so rollback leaves it in place.
}