"""Seed the staff-admin-console feature pack: super_admin invites admin (staff) users.

Revision ID: 104
Revises: 103
"""
from datetime import datetime, timezone
from uuid import uuid4

from alembic import op
import sqlalchemy as sa
from sqlalchemy.dialects import postgresql

revision = "104"
down_revision = "103"
branch_labels = None
depends_on = None

feature_packs = sa.table(
    "feature_packs",
    sa.column("id", postgresql.UUID(as_uuid=True)),
    sa.column("slug", sa.String),
    sa.column("name", sa.String),
    sa.column("description", sa.Text),
    sa.column("version", sa.String),
    sa.column("tags", postgresql.JSONB),
    sa.column("status", sa.String),
    sa.column("composition", postgresql.JSONB),
    sa.column("input_schema", postgresql.JSONB),
    sa.column("access_policy", postgresql.JSONB),
)

_STAFF_INVITE_ENTITY = {
    "entity_key": "staff_invite",
    "name": "Staff Invite",
    "plural_name": "Staff Invites",
    "schema": {
        "fields": [
            {"key": "email", "name": "Email", "type": "text", "required": True, "indexed": True},
            # Value must be the platform's fixed admin role name (auth.admin_role, "admin") —
            # this pack invites staff, not additional super_admins.
            {"key": "role", "name": "Role", "type": "text", "required": True},
            {"key": "status", "name": "Status", "type": "select",
             "options": ["pending", "accepted", "revoked"], "required": True, "indexed": True},
            {"key": "invited_by", "name": "Invited By", "type": "text", "required": True, "indexed": True},
            {"key": "invited_at", "name": "Invited At", "type": "date", "required": True},
            {"key": "accepted_at", "name": "Accepted At", "type": "date"},
        ],
    },
}


def upgrade() -> None:
    now = datetime.now(timezone.utc)
    op.bulk_insert(
        feature_packs,
        [
            {
                "id": uuid4(),
                "slug": "staff-admin-console",
                "name": "Staff Admin Console",
                "description": (
                    "Lets a super_admin invite, track, and revoke admin (staff) users for the "
                    "app's own three-tier auth (super_admin/admin/member) — instead of a "
                    "hand-rolled invite flow per project."
                ),
                "version": "1.0.0",
                "tags": ["auth", "staff", "admin", "roles"],
                "status": "active",
                "composition": {
                    "function_slugs": [],
                    "entities": [_STAFF_INVITE_ENTITY],
                    "connector_actions": [],
                    "requires": [],
                },
                "input_schema": {
                    "type": "object",
                    "properties": {
                        "notify_email": {
                            "type": "boolean",
                            "default": True,
                            "description": "Send an email.send job to the invitee with a link to accept the invite.",
                        },
                        "invite_accept_path": {
                            "type": "string",
                            "default": "/admin/invite/accept",
                            "description": "Route where an invited staff member completes signup and is granted auth.admin_role.",
                        },
                    },
                },
                "access_policy": {"minimum_plan": "free"},
                "created_at": now,
                "updated_at": now,
            },
        ],
    )


def downgrade() -> None:
    op.execute("DELETE FROM feature_packs WHERE slug = 'staff-admin-console'")