"""Track whether the project's auth config actually reached Cloud.

_push_auth_config's Cloud write has always been best-effort at several call sites
(log-and-swallow on failure), with nothing recording whether the last attempt
succeeded. A project could silently run with no Cloud auth config indefinitely.
These two columns let CapabilityProvisioner.status() answer that without a live
Cloud round-trip on every read.

Revision ID: 197
Revises: 196
"""
import sqlalchemy as sa
from alembic import op

revision = "197"
down_revision = "196"
branch_labels = None
depends_on = None


def upgrade() -> None:
    op.add_column(
        "project_auth_config",
        sa.Column("cloud_synced_at", sa.DateTime(timezone=True), nullable=True),
    )
    op.add_column(
        "project_auth_config",
        sa.Column("cloud_sync_error", sa.Text(), nullable=True),
    )


def downgrade() -> None:
    op.drop_column("project_auth_config", "cloud_sync_error")
    op.drop_column("project_auth_config", "cloud_synced_at")