"""Split external-system grants from connections and add definition governance.

Revision ID: 0027
Revises: 0026
Create Date: 2026-08-07
"""

from typing import Sequence, Union

import sqlalchemy as sa
from alembic import op
from sqlalchemy.dialects import postgresql

revision: str = "0027"
down_revision: Union[str, None] = "0026"
branch_labels: Union[str, Sequence[str], None] = None
depends_on: Union[str, Sequence[str], None] = None


def upgrade() -> None:
    op.add_column(
        "external_system_definitions",
        sa.Column("revision", sa.Integer(), server_default="1", nullable=False),
    )
    op.add_column(
        "external_system_definitions",
        sa.Column("owner_type", sa.Text(), server_default="platform", nullable=False),
    )
    op.add_column(
        "external_system_definitions",
        sa.Column("owner_user_id", postgresql.UUID(as_uuid=True), nullable=True),
    )
    op.add_column(
        "external_system_definitions",
        sa.Column("visibility", sa.Text(), server_default="selected", nullable=False),
    )
    op.add_column(
        "external_system_definitions",
        sa.Column("trust_level", sa.Text(), server_default="managed", nullable=False),
    )
    op.add_column(
        "external_system_definitions",
        sa.Column("review_status", sa.Text(), server_default="active", nullable=False),
    )
    op.add_column(
        "external_system_definitions",
        sa.Column("egress_policy_id", sa.Text(), nullable=True),
    )
    op.create_foreign_key(
        "fk_external_system_definitions_owner_user",
        "external_system_definitions",
        "users",
        ["owner_user_id"],
        ["user_id"],
        ondelete="SET NULL",
    )
    op.drop_constraint(
        "uq_external_system_definition_provider_name",
        "external_system_definitions",
        type_="unique",
    )
    op.create_index(
        "uq_external_system_definition_platform_name",
        "external_system_definitions",
        ["provider", "name"],
        unique=True,
        postgresql_where=sa.text("owner_type = 'platform'"),
    )
    op.create_index(
        "uq_external_system_definition_user_name",
        "external_system_definitions",
        ["owner_user_id", "provider", "name"],
        unique=True,
        postgresql_where=sa.text("owner_type = 'user'"),
    )
    op.execute("UPDATE external_system_definitions SET visibility = access_mode")
    op.execute(
        """
        UPDATE external_system_definitions d
        SET config = (d.config - 'allowed_post_operations') || jsonb_build_object(
            'operation_mode',
            CASE WHEN d.provider = 'factory_mes' THEN 'upstream_managed' ELSE 'query' END,
            'operation_policies',
            COALESCE(
                (
                    SELECT jsonb_object_agg(operation_id, 'read')
                    FROM (
                        SELECT jsonb_array_elements_text(
                            COALESCE(d.config->'allowed_post_operations', '[]'::jsonb)
                        ) AS operation_id
                        UNION
                        SELECT operation_id
                        FROM (VALUES ('bi_dataset_exec')) defaults(operation_id)
                        WHERE d.provider = 'factory_mes'
                    ) policies
                ),
                '{}'::jsonb
            )
        )
        """
    )

    op.create_table(
        "external_system_grants",
        sa.Column("definition_id", postgresql.UUID(as_uuid=True), nullable=False),
        sa.Column("user_id", postgresql.UUID(as_uuid=True), nullable=False),
        sa.Column("granted_by", postgresql.UUID(as_uuid=True), nullable=True),
        sa.Column(
            "created_at",
            sa.DateTime(timezone=True),
            server_default=sa.text("now()"),
            nullable=False,
        ),
        sa.ForeignKeyConstraint(
            ["definition_id"],
            ["external_system_definitions.definition_id"],
            ondelete="CASCADE",
        ),
        sa.ForeignKeyConstraint(["user_id"], ["users.user_id"], ondelete="CASCADE"),
        sa.ForeignKeyConstraint(["granted_by"], ["users.user_id"], ondelete="SET NULL"),
        sa.PrimaryKeyConstraint("definition_id", "user_id"),
    )
    op.execute(
        """
        INSERT INTO external_system_grants (definition_id, user_id, granted_by)
        SELECT DISTINCT es.definition_id, es.user_id, d.created_by
        FROM external_systems es
        JOIN external_system_definitions d ON d.definition_id = es.definition_id
        WHERE d.access_mode = 'selected'
        """
    )

    op.add_column(
        "external_systems",
        sa.Column("credential_hint", sa.Text(), server_default="***", nullable=False),
    )
    op.add_column(
        "external_systems",
        sa.Column(
            "verified_revision", sa.Integer(), server_default="0", nullable=False
        ),
    )
    op.add_column("external_systems", sa.Column("last_error", sa.Text(), nullable=True))
    op.execute(
        """
        UPDATE external_systems es
        SET verified_revision = d.revision
        FROM external_system_definitions d
        WHERE d.definition_id = es.definition_id
          AND es.status IN ('active', 'invalid')
          AND es.credentials <> '{}'::jsonb
        """
    )
    op.execute("DELETE FROM external_systems WHERE status = 'pending'")
    op.drop_column("external_systems", "config")
    op.drop_column("external_systems", "connector")
    op.drop_column("external_systems", "provider")
    op.drop_column("external_system_definitions", "access_mode")
    op.create_table(
        "external_system_audits",
        sa.Column("audit_id", postgresql.UUID(as_uuid=True), nullable=False),
        sa.Column("user_id", postgresql.UUID(as_uuid=True), nullable=False),
        sa.Column("task_id", postgresql.UUID(as_uuid=True), nullable=True),
        sa.Column("external_system_id", postgresql.UUID(as_uuid=True), nullable=True),
        sa.Column("definition_id", postgresql.UUID(as_uuid=True), nullable=True),
        sa.Column("definition_revision", sa.Integer(), nullable=False),
        sa.Column("event", sa.Text(), nullable=False),
        sa.Column("operation_id", sa.Text(), nullable=True),
        sa.Column("outcome", sa.Text(), nullable=False),
        sa.Column("status_code", sa.Integer(), nullable=True),
        sa.Column("duration_ms", sa.Integer(), nullable=False),
        sa.Column("response_bytes", sa.BigInteger(), nullable=True),
        sa.Column(
            "detail",
            postgresql.JSONB(astext_type=sa.Text()),
            server_default=sa.text("'{}'::jsonb"),
            nullable=False,
        ),
        sa.Column(
            "created_at",
            sa.DateTime(timezone=True),
            server_default=sa.text("now()"),
            nullable=False,
        ),
        sa.ForeignKeyConstraint(["user_id"], ["users.user_id"], ondelete="CASCADE"),
        sa.ForeignKeyConstraint(["task_id"], ["tasks.task_id"], ondelete="SET NULL"),
        sa.ForeignKeyConstraint(
            ["external_system_id"],
            ["external_systems.external_system_id"],
            ondelete="SET NULL",
        ),
        sa.ForeignKeyConstraint(
            ["definition_id"],
            ["external_system_definitions.definition_id"],
            ondelete="SET NULL",
        ),
        sa.PrimaryKeyConstraint("audit_id"),
    )
    op.create_index(
        "ix_external_system_audits_user_created",
        "external_system_audits",
        ["user_id", "created_at"],
    )


def downgrade() -> None:
    op.drop_index(
        "ix_external_system_audits_user_created",
        table_name="external_system_audits",
    )
    op.drop_table("external_system_audits")
    op.add_column(
        "external_system_definitions",
        sa.Column("access_mode", sa.Text(), server_default="selected", nullable=False),
    )
    op.execute("UPDATE external_system_definitions SET access_mode = visibility")
    op.add_column(
        "external_systems",
        sa.Column(
            "provider", sa.Text(), server_default="generic_openapi", nullable=False
        ),
    )
    op.add_column(
        "external_systems",
        sa.Column("connector", sa.Text(), server_default="openapi", nullable=False),
    )
    op.add_column(
        "external_systems",
        sa.Column(
            "config",
            postgresql.JSONB(astext_type=sa.Text()),
            server_default=sa.text("'{}'::jsonb"),
            nullable=False,
        ),
    )
    op.execute(
        """
        UPDATE external_systems es
        SET provider = d.provider
        FROM external_system_definitions d
        WHERE d.definition_id = es.definition_id
        """
    )
    op.execute(
        """
        INSERT INTO external_systems (
            external_system_id, user_id, definition_id, provider, connector, name,
            credentials, config, status
        )
        SELECT md5(g.definition_id::text || ':' || g.user_id::text)::uuid,
               g.user_id, g.definition_id, d.provider, 'openapi',
               d.name, '{}'::jsonb, '{}'::jsonb, 'pending'
        FROM external_system_grants g
        JOIN external_system_definitions d ON d.definition_id = g.definition_id
        WHERE NOT EXISTS (
            SELECT 1 FROM external_systems es
            WHERE es.user_id = g.user_id AND es.definition_id = g.definition_id
        )
        """
    )
    op.execute(
        """
        UPDATE external_system_definitions d
        SET config = (d.config - 'operation_policies' - 'operation_mode') || jsonb_build_object(
            'allowed_post_operations',
            COALESCE(
                (
                    SELECT jsonb_agg(operation_id)
                    FROM jsonb_object_keys(
                        COALESCE(d.config->'operation_policies', '{}'::jsonb)
                    ) operation_id
                ),
                '[]'::jsonb
            )
        )
        """
    )
    op.alter_column("external_systems", "provider", server_default=None)
    op.alter_column("external_systems", "config", server_default=None)
    op.drop_column("external_systems", "last_error")
    op.drop_column("external_systems", "verified_revision")
    op.drop_column("external_systems", "credential_hint")
    op.drop_table("external_system_grants")
    op.drop_constraint(
        "fk_external_system_definitions_owner_user",
        "external_system_definitions",
        type_="foreignkey",
    )
    op.drop_index(
        "uq_external_system_definition_user_name",
        table_name="external_system_definitions",
    )
    op.drop_index(
        "uq_external_system_definition_platform_name",
        table_name="external_system_definitions",
    )
    op.create_unique_constraint(
        "uq_external_system_definition_provider_name",
        "external_system_definitions",
        ["provider", "name"],
    )
    op.drop_column("external_system_definitions", "egress_policy_id")
    op.drop_column("external_system_definitions", "review_status")
    op.drop_column("external_system_definitions", "trust_level")
    op.drop_column("external_system_definitions", "visibility")
    op.drop_column("external_system_definitions", "owner_user_id")
    op.drop_column("external_system_definitions", "owner_type")
    op.drop_column("external_system_definitions", "revision")