"""Ensure system roles include projects.read for list/get project APIs.

Revision ID: 010
Revises: 009
"""
from typing import Sequence, Union

from alembic import op

revision: str = "010"
down_revision: Union[str, None] = "009"
branch_labels: Union[str, Sequence[str], None] = None
depends_on: Union[str, Sequence[str], None] = None


def upgrade() -> None:
    # Match src/domain/workspaces/models.py ROLE_PERMISSIONS (system roles: workspace_id IS NULL)
    op.execute(
        """
        UPDATE roles SET permissions = ARRAY[
          'projects.read','projects.create','projects.write',
          'previews.manage','codegen.run','instructions.manage'
        ]::varchar[]
        WHERE LOWER(name) = 'editor' AND workspace_id IS NULL;
        """
    )
    op.execute(
        """
        UPDATE roles SET permissions = ARRAY[
          'projects.read','projects.write','codegen.run',
          'previews.manage','deploy.publish'
        ]::varchar[]
        WHERE LOWER(name) = 'developer' AND workspace_id IS NULL;
        """
    )
    op.execute(
        """
        UPDATE roles SET permissions = ARRAY['projects.read']::varchar[]
        WHERE LOWER(name) = 'viewer' AND workspace_id IS NULL;
        """
    )


def downgrade() -> None:
    op.execute(
        """
        UPDATE roles SET permissions = ARRAY[
          'projects.create','projects.write',
          'previews.manage','codegen.run','instructions.manage'
        ]::varchar[]
        WHERE LOWER(name) = 'editor' AND workspace_id IS NULL;
        """
    )
    op.execute(
        """
        UPDATE roles SET permissions = ARRAY[
          'projects.write','codegen.run','previews.manage','deploy.publish'
        ]::varchar[]
        WHERE LOWER(name) = 'developer' AND workspace_id IS NULL;
        """
    )
    op.execute(
        """
        UPDATE roles SET permissions = ARRAY['projects.create']::varchar[]
        WHERE LOWER(name) = 'viewer' AND workspace_id IS NULL;
        """
    )