defmodule Towerops.Repo.Migrations.InvalidateBcryptPasswords do
  use Ecto.Migration

  def up do
    # Invalidate all existing bcrypt password hashes
    # Users will need to reset their passwords via the "Forgot password?" flow
    execute "UPDATE users SET hashed_password = NULL WHERE hashed_password IS NOT NULL"
  end

  def down do
    # Cannot restore bcrypt hashes - this migration is irreversible
    :ok
  end
end
