"""Add environment + allow_dns_request to cmdb_domains.

Revision ID: 158
Revises: 157
Create Date: 2026-05-13

Why
---
Two new admin-controlled columns on ``cmdb_domains``:

* ``environment`` (VARCHAR 16, NULL) — lifecycle classification the IT Admin
  assigns after a cloud sync: prod / staging / dev / test.  Not derivable
  from the registrar API so it stays NULL until explicitly set.

* ``allow_dns_request`` (BOOLEAN, NOT NULL, DEFAULT TRUE) — gate flag.
  When the IT Admin sets this to FALSE the domain disappears from the
  employee self-service Zone picker (``GET /cmdb/domains/selectable-for-dns``).
  Typical use-case: production domains that employees must not accidentally
  create DNS records on without a security review.

Default: TRUE so existing domains remain fully requestable after the
migration; admins opt-out individual domains rather than opt-in.
"""

from alembic import op
import sqlalchemy as sa

revision = "158"
down_revision = "157"
branch_labels = None
depends_on = None


def upgrade() -> None:
    op.add_column(
        "cmdb_domains",
        sa.Column("environment", sa.String(16), nullable=True),
    )
    op.add_column(
        "cmdb_domains",
        sa.Column(
            "allow_dns_request",
            sa.Boolean(),
            nullable=False,
            server_default=sa.true(),
        ),
    )


def downgrade() -> None:
    op.drop_column("cmdb_domains", "allow_dns_request")
    op.drop_column("cmdb_domains", "environment")