"""Core-owned agent clients, grants, hashed credentials, and operation outbox."""

from alembic import op
import sqlalchemy as sa

revision = "096"
down_revision = "095"
branch_labels = None
depends_on = None


def upgrade():
    op.create_table(
        "agent_clients",
        sa.Column("id", sa.String(64), primary_key=True),
        sa.Column("name", sa.String(100), nullable=False),
        sa.Column("redirect_uris", sa.JSON(), nullable=False),
        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
    )
    op.create_table(
        "agent_grants",
        sa.Column("id", sa.Uuid(), primary_key=True),
        sa.Column("workspace_id", sa.Uuid(), sa.ForeignKey("workspaces.id"), nullable=False),
        sa.Column("created_by", sa.Uuid(), sa.ForeignKey("users.id"), nullable=False),
        sa.Column("client_id", sa.String(64), sa.ForeignKey("agent_clients.id")),
        sa.Column("name", sa.String(100), nullable=False),
        sa.Column("kind", sa.String(16), nullable=False),
        sa.Column("scopes", sa.JSON(), nullable=False),
        sa.Column("project_ids", sa.JSON(), nullable=False),
        sa.Column("workspace_wide", sa.Boolean(), nullable=False),
        sa.Column("purchase_policy", sa.JSON(), nullable=False),
        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
        sa.Column("revoked_at", sa.DateTime(timezone=True)),
        sa.Column("revoked_by", sa.Uuid(), sa.ForeignKey("users.id")),
        sa.Column("revocation_reason", sa.String(40)),
        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
        sa.CheckConstraint("kind IN ('user', 'service')", name="ck_agent_grant_kind"),
    )
    op.create_index("ix_agent_grants_workspace_id", "agent_grants", ["workspace_id"])
    op.create_table(
        "agent_credentials",
        sa.Column("fingerprint", sa.String(64), primary_key=True),
        sa.Column("grant_id", sa.Uuid(), sa.ForeignKey("agent_grants.id"), nullable=False),
        sa.Column("kind", sa.String(16), nullable=False),
        sa.Column("client_id", sa.String(64), nullable=False),
        sa.Column("details", sa.JSON(), nullable=False),
        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
        sa.Column("consumed_at", sa.DateTime(timezone=True)),
        sa.CheckConstraint(
            "kind IN ('code', 'access', 'refresh', 'service')", name="ck_agent_credential_kind"
        ),
    )
    op.create_index("ix_agent_credentials_grant_id", "agent_credentials", ["grant_id"])
    op.create_table(
        "agent_operations",
        sa.Column("id", sa.Uuid(), primary_key=True),
        sa.Column("grant_id", sa.Uuid(), sa.ForeignKey("agent_grants.id"), nullable=False),
        sa.Column("workspace_id", sa.Uuid(), sa.ForeignKey("workspaces.id"), nullable=False),
        sa.Column("request_key", sa.String(128), nullable=False),
        sa.Column("action", sa.String(40), nullable=False),
        sa.Column("request_hash", sa.String(64), nullable=False),
        sa.Column("arguments", sa.JSON(), nullable=False),
        sa.Column("status", sa.String(24), nullable=False),
        sa.Column("result", sa.JSON(), nullable=False),
        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False),
        sa.UniqueConstraint("grant_id", "request_key", name="uq_agent_operation_key"),
    )
    for column in ("grant_id", "workspace_id", "status"):
        op.create_index(f"ix_agent_operations_{column}", "agent_operations", [column])


def downgrade():
    op.drop_table("agent_operations")
    op.drop_table("agent_credentials")
    op.drop_table("agent_grants")
    op.drop_table("agent_clients")