"""Add tls_verify column to ldap_configs (H-07 security fix)

Revision ID: 0008_ldap_tls_verify
Revises: 0007_caldav_and_fixes
Create Date: 2026-03-27

Security fix H-07: make LDAP certificate validation configurable.
Default is False for backwards compatibility; set True in production
to enforce CERT_REQUIRED and prevent MITM attacks.
"""
from alembic import op
import sqlalchemy as sa


revision = "0008_ldap_tls_verify"
down_revision = "0007_caldav_and_fixes"
branch_labels = None
depends_on = None


def upgrade() -> None:
    op.add_column(
        "ldap_configs",
        sa.Column("tls_verify", sa.Boolean(), nullable=False, server_default="false"),
    )


def downgrade() -> None:
    op.drop_column("ldap_configs", "tls_verify")