<?php

declare(strict_types=1);
if ( ! defined( 'ABSPATH' ) ) { exit; }

/**
 * Migration 0003 — Security Layer (T7)
 *
 * instinctor_rate_limits  — sliding-window rate limit counters
 *   key          unique bucket string (e.g. "login:127.0.0.1")
 *   hits         request count within the current window
 *   window_start unix timestamp of window start
 *   expires_at   datetime the window resets (for pruning)
 *
 * instinctor_login_attempts — brute-force tracking
 *   identifier   email or username attempted
 *   ip           IPv4/IPv6
 *   attempted_at datetime of attempt
 *   success      1 = successful login
 */
return [
    'description' => 'Security — rate_limits and login_attempts tables',

    'up' => [
        "CREATE TABLE IF NOT EXISTS {prefix}instinctor_rate_limits (
            `key`        VARCHAR(255) NOT NULL,
            hits         INT UNSIGNED NOT NULL DEFAULT 1,
            window_start INT UNSIGNED NOT NULL,
            expires_at   DATETIME     NOT NULL,
            PRIMARY KEY (`key`),
            KEY idx_expires (expires_at)
        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",

        "CREATE TABLE IF NOT EXISTS {prefix}instinctor_login_attempts (
            id           BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
            identifier   VARCHAR(255)    NOT NULL,
            ip           VARCHAR(45)     NOT NULL,
            attempted_at DATETIME        NOT NULL DEFAULT CURRENT_TIMESTAMP,
            success      TINYINT(1)      NOT NULL DEFAULT 0,
            PRIMARY KEY (id),
            KEY idx_identifier   (identifier),
            KEY idx_ip           (ip),
            KEY idx_attempted_at (attempted_at)
        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci",
    ],

    'down' => [
        "DROP TABLE IF EXISTS {prefix}instinctor_rate_limits",
        "DROP TABLE IF EXISTS {prefix}instinctor_login_attempts",
    ],
];
