<?php
declare(strict_types=1);

use Phinx\Db\Adapter\AdapterInterface;
use Phinx\Migration\AbstractMigration;

/**
 * Per-user 2FA flags on the users table (Plan 007 §3).
 *
 * Both are additive with safe defaults — no existing column changes, no
 * backfill. `two_factor_enabled` defaults false so a consumer that never turns
 * 2FA on sees no change. `two_factor_confirmed_at` is set once, at the first
 * successful verify, distinguishing a live 2FA user from a mid-setup one.
 */
final class AddTwoFactorToUsers extends AbstractMigration
{
    public function change(): void
    {
        $this->table('users')
            ->addColumn('two_factor_enabled', AdapterInterface::PHINX_TYPE_BOOLEAN, [
                'null' => false,
                'default' => false,
            ])
            // Unix timestamp (INTEGER), matching the users table's created/modified.
            ->addColumn('two_factor_confirmed_at', AdapterInterface::PHINX_TYPE_INTEGER, [
                'null' => true,
                'default' => null,
            ])
            ->update();
    }
}
