-- +goose Up
CREATE TABLE IF NOT EXISTS waf_alerts (
    id         BIGSERIAL PRIMARY KEY,
    domain_id  BIGINT REFERENCES domains(id) ON DELETE CASCADE,
    hostname   TEXT        NOT NULL,
    client_ip  TEXT        NOT NULL,
    method     TEXT        NOT NULL,
    uri        TEXT        NOT NULL,
    rule_id    INT         NOT NULL DEFAULT 0,
    rule_msg   TEXT        NOT NULL DEFAULT '',
    severity   TEXT        NOT NULL DEFAULT '',
    action     TEXT        NOT NULL,          -- 'detected' | 'blocked'
    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

CREATE INDEX IF NOT EXISTS waf_alerts_domain_created ON waf_alerts(domain_id, created_at DESC);
CREATE INDEX IF NOT EXISTS waf_alerts_created ON waf_alerts(created_at DESC);

-- +goose Down
DROP TABLE IF EXISTS waf_alerts;