"""Add analytics drill-down IP metadata and clone/proxy security log."""
import sqlite3

def migrate(db_path):
    conn=sqlite3.connect(db_path)
    cur=conn.cursor()
    for table,col,ddl in [("analytics_sessions","ip_masked","TEXT"),("analytics_sessions","ip_source","TEXT"),("analytics_events","ip_masked","TEXT"),("analytics_events","ip_source","TEXT")]:
        cols={r[1] for r in cur.execute(f"PRAGMA table_info({table})")}
        if col not in cols: cur.execute(f"ALTER TABLE {table} ADD COLUMN {col} {ddl}")
    cur.executescript("""CREATE TABLE IF NOT EXISTS security_events (id INTEGER PRIMARY KEY,event_type TEXT,reason TEXT,request_host TEXT,forwarded_host TEXT,origin TEXT,referrer TEXT,source_ip_masked TEXT,source_ip_hash TEXT,endpoint TEXT,path TEXT,method TEXT,user_agent TEXT,created_at TEXT); CREATE INDEX IF NOT EXISTS idx_security_events_created ON security_events(created_at);""")
    conn.commit(); conn.close()