"""add reusable core credential envelopes

Revision ID: c91f0a72be34
Revises: 0f1e2d3c4b5a
Create Date: 2026-07-23 00:00:00.000000
"""
from __future__ import annotations

from alembic import op
import sqlalchemy as sa


revision = "c91f0a72be34"
down_revision = "0f1e2d3c4b5a"
branch_labels = None
depends_on = None


def upgrade() -> None:
    inspector = sa.inspect(op.get_bind())
    if "core_credential_envelopes" in inspector.get_table_names():
        return
    op.create_table(
        "core_credential_envelopes",
        sa.Column("id", sa.String(length=36), nullable=False),
        sa.Column("tenant_id", sa.String(length=36), nullable=True),
        sa.Column("scope_type", sa.String(length=20), nullable=False),
        sa.Column("scope_id", sa.String(length=255), nullable=True),
        sa.Column("name", sa.String(length=255), nullable=False),
        sa.Column("description", sa.Text(), nullable=True),
        sa.Column("credential_kind", sa.String(length=40), nullable=False),
        sa.Column("public_data", sa.JSON(), nullable=False),
        sa.Column("secret_data_encrypted", sa.Text(), nullable=True),
        sa.Column("secret_keys", sa.JSON(), nullable=False),
        sa.Column("allowed_modules", sa.JSON(), nullable=False),
        sa.Column("allowed_server_refs", sa.JSON(), nullable=False),
        sa.Column("inherit_to_lower_scopes", sa.Boolean(), nullable=False),
        sa.Column("is_active", sa.Boolean(), nullable=False),
        sa.Column("revision", sa.String(length=36), nullable=False),
        sa.Column("created_by_user_id", sa.String(length=36), nullable=True),
        sa.Column("updated_by_user_id", sa.String(length=36), nullable=True),
        sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
        sa.Column("metadata", sa.JSON(), nullable=True),
        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False),
        sa.ForeignKeyConstraint(
            ["tenant_id"],
            ["core_scopes.id"],
            name=op.f("fk_core_credential_envelopes_tenant_id_core_scopes"),
            ondelete="CASCADE",
        ),
        sa.PrimaryKeyConstraint("id", name=op.f("pk_core_credential_envelopes")),
    )
    op.create_index(
        "ix_core_credential_envelopes_scope",
        "core_credential_envelopes",
        ["tenant_id", "scope_type", "scope_id"],
        unique=False,
    )
    op.create_index(
        "ix_core_credential_envelopes_active",
        "core_credential_envelopes",
        ["tenant_id", "is_active", "deleted_at"],
        unique=False,
    )
    for column in (
        "tenant_id",
        "scope_type",
        "scope_id",
        "credential_kind",
        "is_active",
        "created_by_user_id",
        "updated_by_user_id",
        "deleted_at",
    ):
        op.create_index(
            op.f(f"ix_core_credential_envelopes_{column}"),
            "core_credential_envelopes",
            [column],
            unique=False,
        )


def downgrade() -> None:
    inspector = sa.inspect(op.get_bind())
    if "core_credential_envelopes" in inspector.get_table_names():
        op.drop_table("core_credential_envelopes")
