"""Add explicit app auth and MFA policy fields to project_auth_config.

Revision ID: 130
Revises: 129

Originally authored as "082" before ever being committed, chained off "081" as if
this landed back then -- but 083-129 were built on top of the real 082
(devices_desktop_execution_agent) in the meantime, so that revision id collided and
broke the chain outright (alembic history/current/upgrade all failed at script-load
time). Renumbered to its real place at the tip; no content change.
"""
from alembic import op
import sqlalchemy as sa
from sqlalchemy.dialects import postgresql

revision = "130"
down_revision = "129"
branch_labels = None
depends_on = None


def upgrade() -> None:
    op.add_column(
        "project_auth_config",
        sa.Column("auth_methods", postgresql.JSONB(), nullable=False, server_default="[]"),
    )
    op.add_column(
        "project_auth_config",
        sa.Column("mfa_methods", postgresql.JSONB(), nullable=False, server_default="[]"),
    )
    op.add_column(
        "project_auth_config",
        sa.Column("require_mfa", sa.Boolean(), nullable=False, server_default="false"),
    )

    op.execute(
        """
        UPDATE project_auth_config
        SET auth_methods = CASE
            WHEN providers ? 'password' THEN
                CASE
                    WHEN providers ? 'google' AND (providers ? 'email' OR providers ? 'magic_link')
                        THEN '["password","google","passwordless"]'::jsonb
                    WHEN providers ? 'google'
                        THEN '["password","google"]'::jsonb
                    WHEN providers ? 'email' OR providers ? 'magic_link'
                        THEN '["password","passwordless"]'::jsonb
                    ELSE '["password"]'::jsonb
                END
            WHEN providers ? 'google' AND (providers ? 'email' OR providers ? 'magic_link')
                THEN '["google","passwordless"]'::jsonb
            WHEN providers ? 'google'
                THEN '["google"]'::jsonb
            WHEN providers ? 'email' OR providers ? 'magic_link'
                THEN '["passwordless"]'::jsonb
            ELSE '[]'::jsonb
        END
        """
    )


def downgrade() -> None:
    op.drop_column("project_auth_config", "require_mfa")
    op.drop_column("project_auth_config", "mfa_methods")
    op.drop_column("project_auth_config", "auth_methods")