"""An account may have no password.

Single sign-on wrote a random string nobody would ever know, which reads as
"has a password" to everything that asks — so Settings demanded a current
password before it would let those accounts set their first, and the only way
through was to click "forgot password" for one they never had.

Null says the true thing. The random strings already written are left alone:
they are unguessable, so nothing can sign in with them, and clearing them would
mean deciding from outside which accounts were meant to have one.

Revision ID: h1b2c3d4e5f6
Revises: g9a1b2c3d4e5
"""
import sqlalchemy as sa
from alembic import op

revision = "h1b2c3d4e5f6"
down_revision = "g9a1b2c3d4e5"
branch_labels = None
depends_on = None


def upgrade():
    op.alter_column("users", "hashed_password", existing_type=sa.String(), nullable=True)


def downgrade():
    op.execute("UPDATE users SET hashed_password = '' WHERE hashed_password IS NULL")
    op.alter_column("users", "hashed_password", existing_type=sa.String(), nullable=False)