"""Owner approval for security-sensitive capabilities declared by the coding agent.

Revision ID: 177
Revises: 176
"""
import sqlalchemy as sa
from alembic import op
from sqlalchemy.dialects import postgresql

revision = "177"
down_revision = "176"
branch_labels = None
depends_on = None


def upgrade():
    op.create_table(
        "project_capability_approvals",
        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
        sa.Column(
            "project_id", postgresql.UUID(as_uuid=True),
            sa.ForeignKey("projects.id", ondelete="CASCADE"), nullable=False,
        ),
        sa.Column("fingerprint", sa.String(64), nullable=False),
        sa.Column("kind", sa.String(16), nullable=False),
        sa.Column("name", sa.String(100), nullable=False),
        sa.Column("summary", sa.Text(), nullable=False),
        sa.Column("grants", postgresql.JSONB(), nullable=False, server_default=sa.text("'[]'::jsonb")),
        sa.Column("status", sa.String(16), nullable=False, server_default="pending"),
        sa.Column("requested_run_id", postgresql.UUID(as_uuid=True), nullable=True),
        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
        sa.Column("decided_at", sa.DateTime(timezone=True), nullable=True),
        sa.Column(
            "decided_by", postgresql.UUID(as_uuid=True),
            sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True,
        ),
        sa.UniqueConstraint("project_id", "fingerprint", name="uq_capability_approval_fingerprint"),
        sa.CheckConstraint(
            "status IN ('pending', 'approved', 'rejected')", name="ck_capability_approval_status"
        ),
        sa.CheckConstraint(
            "kind IN ('compose', 'pack_install')", name="ck_capability_approval_kind"
        ),
    )
    op.create_index(
        "ix_project_capability_approvals_project_id", "project_capability_approvals", ["project_id"]
    )


def downgrade():
    op.drop_table("project_capability_approvals")