"""workspace_connector_defaults — per-workspace credential templates for connectors.

Stores encrypted credentials/config that can be copied into a project-scoped
ConnectorConnection on demand. Not a live shared connection — strictly a template.

Revision ID: 056
Revises: 055
"""
from alembic import op
import sqlalchemy as sa
from sqlalchemy.dialects.postgresql import JSONB
from sqlalchemy.dialects.postgresql import UUID as PGUUID

revision = "056"
down_revision = "055"
branch_labels = None
depends_on = None


def upgrade() -> None:
    op.create_table(
        "workspace_connector_defaults",
        sa.Column("id", PGUUID(as_uuid=True), primary_key=True),
        sa.Column(
            "workspace_id",
            PGUUID(as_uuid=True),
            sa.ForeignKey("workspaces.id", ondelete="CASCADE"),
            nullable=False,
            index=True,
        ),
        sa.Column("connector_key", sa.String(length=64), nullable=False),
        sa.Column("config_json", JSONB(), nullable=True),
        sa.Column("secrets_enc", JSONB(), nullable=True),
        sa.Column("scopes", JSONB(), nullable=False, server_default="[]"),
        sa.Column("default_permissions", JSONB(), nullable=False, server_default="{}"),
        sa.Column(
            "created_at",
            sa.DateTime(timezone=True),
            server_default=sa.func.now(),
            nullable=False,
        ),
        sa.Column(
            "updated_at",
            sa.DateTime(timezone=True),
            server_default=sa.func.now(),
            nullable=False,
        ),
        sa.UniqueConstraint(
            "workspace_id",
            "connector_key",
            name="uq_workspace_connector_defaults_ws_key",
        ),
    )


def downgrade() -> None:
    op.drop_table("workspace_connector_defaults")