<?php

declare(strict_types=1);

/**
 * M19 hardening: password reset support.
 *
 * Adds:
 * - reset_token_hash (sha256)
 * - reset_token_expires_at (datetime)
 *
 * @return callable(PDO, string): void
 */
return static function (\PDO $pdo, string $prefix): void {
    if (!preg_match('/^[a-zA-Z0-9_]+$/', $prefix)) {
        throw new InvalidArgumentException('Invalid table prefix');
    }

    $users = '`' . $prefix . 'users`';

    try { $pdo->exec("ALTER TABLE {$users} ADD COLUMN `reset_token_hash` varchar(64) NULL AFTER `is_owner`"); } catch (\Throwable) {}
    try { $pdo->exec("ALTER TABLE {$users} ADD COLUMN `reset_token_expires_at` datetime NULL AFTER `reset_token_hash`"); } catch (\Throwable) {}
    try { $pdo->exec("ALTER TABLE {$users} ADD KEY `idx_reset` (`reset_token_hash`)"); } catch (\Throwable) {}
};

