"""SSH key registry and credential management

Revision ID: 0011
Revises: 0010
Create Date: 2026-04-09
"""

from alembic import op
import sqlalchemy as sa
from sqlalchemy.dialects.postgresql import JSONB

revision = "0011"
down_revision = "0010"
branch_labels = None
depends_on = None


def upgrade() -> None:
    # --- SSH key file registry ---
    op.create_table(
        "ssh_keys",
        sa.Column("id", sa.Integer, primary_key=True),
        sa.Column("name", sa.String(100), nullable=False, unique=True),
        sa.Column("path", sa.String(500), nullable=False),
        sa.Column("description", sa.String(1000), nullable=True),
        sa.Column(
            "created_at",
            sa.DateTime(timezone=True),
            server_default=sa.text("now()"),
            nullable=False,
        ),
    )

    # --- Ordered SSH credential list per object ---
    op.create_table(
        "object_ssh_credentials",
        sa.Column("id", sa.Integer, primary_key=True),
        sa.Column(
            "object_id",
            sa.Integer,
            sa.ForeignKey("objects.id", ondelete="CASCADE"),
            nullable=False,
        ),
        sa.Column("type", sa.String(10), nullable=False),
        sa.Column("username", sa.String(100), nullable=False),
        sa.Column("password_enc", sa.String(500), nullable=True),
        sa.Column(
            "ssh_key_id",
            sa.Integer,
            sa.ForeignKey("ssh_keys.id", ondelete="SET NULL"),
            nullable=True,
        ),
        sa.Column("priority", sa.Integer, nullable=False, server_default="0"),
        sa.CheckConstraint("type IN ('password', 'key')", name="ck_obj_ssh_cred_type"),
    )
    op.create_index(
        "ix_obj_ssh_creds_object", "object_ssh_credentials", ["object_id"]
    )

    # --- Per-category credentials per object (SSH + HTTP) ---
    op.create_table(
        "object_category_credentials",
        sa.Column("id", sa.Integer, primary_key=True),
        sa.Column(
            "object_id",
            sa.Integer,
            sa.ForeignKey("objects.id", ondelete="CASCADE"),
            nullable=False,
        ),
        sa.Column("category", sa.String(20), nullable=False),
        sa.Column("protocol", sa.String(10), nullable=False),
        sa.Column("type", sa.String(10), nullable=False, server_default="password"),
        sa.Column("username", sa.String(100), nullable=False),
        sa.Column("password_enc", sa.String(500), nullable=True),
        sa.Column(
            "ssh_key_id",
            sa.Integer,
            sa.ForeignKey("ssh_keys.id", ondelete="SET NULL"),
            nullable=True,
        ),
        sa.Column("priority", sa.Integer, nullable=False, server_default="0"),
        sa.CheckConstraint(
            "protocol IN ('ssh', 'http')", name="ck_obj_cat_cred_protocol"
        ),
        sa.CheckConstraint("type IN ('password', 'key')", name="ck_obj_cat_cred_type"),
    )
    op.create_index(
        "ix_obj_cat_creds_object", "object_category_credentials", ["object_id"]
    )

    # --- Device-level additions ---
    op.add_column(
        "devices",
        sa.Column(
            "ssh_key_id_override",
            sa.Integer,
            sa.ForeignKey("ssh_keys.id", ondelete="SET NULL"),
            nullable=True,
        ),
    )
    op.add_column("devices", sa.Column("ssh_last_auth", JSONB, nullable=True))


def downgrade() -> None:
    op.drop_column("devices", "ssh_last_auth")
    op.drop_column("devices", "ssh_key_id_override")

    op.drop_index("ix_obj_cat_creds_object", table_name="object_category_credentials")
    op.drop_table("object_category_credentials")

    op.drop_index("ix_obj_ssh_creds_object", table_name="object_ssh_credentials")
    op.drop_table("object_ssh_credentials")

    op.drop_table("ssh_keys")