-- +goose Up
CREATE TABLE IF NOT EXISTS waf_configs (
    id              SERIAL PRIMARY KEY,
    domain_id       BIGINT NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
    enabled         BOOLEAN  NOT NULL DEFAULT false,
    mode            TEXT     NOT NULL DEFAULT 'detection'
                             CHECK (mode IN ('detection','blocking')),
    paranoia_level  INT      NOT NULL DEFAULT 1
                             CHECK (paranoia_level BETWEEN 1 AND 4),
    rule_exclusions TEXT[]   NOT NULL DEFAULT '{}',
    trusted_proxies TEXT[]   NOT NULL DEFAULT '{}',
    custom_rules    TEXT     NOT NULL DEFAULT '',
    updated_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    CONSTRAINT waf_configs_domain_unique UNIQUE (domain_id)
);

-- +goose Down
DROP TABLE IF EXISTS waf_configs;