"""Add encrypted provider credentials control plane.

Revision ID: 0039
Revises: 0038
Create Date: 2026-09-02
"""
from collections.abc import Sequence

import sqlalchemy as sa
from alembic import op
from sqlalchemy.dialects import postgresql

revision: str = "0039"
down_revision: str | None = "0038"
branch_labels: str | Sequence[str] | None = None
depends_on: str | Sequence[str] | None = None


def upgrade() -> None:
    op.create_table(
        "provider_credentials",
        sa.Column("provider_id", sa.Text(), primary_key=True),
        sa.Column("credentials", postgresql.JSONB(), nullable=False),
        sa.Column("credential_hint", postgresql.JSONB(), nullable=False),
        sa.Column("revision", sa.Integer(), server_default="1", nullable=False),
        sa.Column("test_status", sa.Text(), server_default="untested", nullable=False),
        sa.Column("test_detail", sa.Text(), nullable=True),
        sa.Column("balance_amount", sa.Numeric(18, 6), nullable=True),
        sa.Column("balance_currency", sa.Text(), nullable=True),
        sa.Column("last_tested_at", sa.DateTime(timezone=True), nullable=True),
        sa.Column("last_notified_at", sa.DateTime(timezone=True), nullable=True),
        sa.Column("last_notified_status", sa.Text(), nullable=True),
        sa.Column(
            "updated_by",
            postgresql.UUID(as_uuid=True),
            sa.ForeignKey("users.user_id", ondelete="SET NULL"),
            nullable=True,
        ),
        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
        sa.CheckConstraint("revision > 0", name="ck_provider_credentials_revision_positive"),
    )


def downgrade() -> None:
    op.drop_table("provider_credentials")