"""backfill email_verified for Google accounts

Revision ID: 0024_google_email_verified
Revises: 0023_user_suspension
Create Date: 2026-06-19

A Google sign-in proves the email, but earlier Google signups were created with
email_verified=false (the callback didn't set it). Backfill those so the flag reflects reality —
matters because password-login gates on email_verified, so a Google user who later adds a password
must count as verified. Demo/password-only rows (google_sub IS NULL) are left untouched.
"""
from typing import Sequence, Union

from alembic import op

revision: str = "0024_google_email_verified"
down_revision: Union[str, None] = "0023_user_suspension"
branch_labels: Union[str, Sequence[str], None] = None
depends_on: Union[str, Sequence[str], None] = None


def upgrade() -> None:
    op.execute(
        "UPDATE users SET email_verified = true "
        "WHERE google_sub IS NOT NULL AND email_verified = false"
    )


def downgrade() -> None:
    # Not reversible — we can't tell which rows were flipped. No-op.
    pass