leocrm/alembic/versions/0055_entity_policies.py

"""Create entity_policies table for ABAC engine.

Revision ID: 0055
Revises: 0054
Create Date: 2026-07-29
"""

from alembic import op
import sqlalchemy as sa
from sqlalchemy.dialects.postgresql import JSONB, UUID as PGUUID

revision = "0055"
down_revision = "0054"
branch_labels = None
depends_on = None


def upgrade() -> None:
    op.create_table(
        "entity_policies",
        sa.Column("id", PGUUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
        sa.Column("name", sa.String(200), nullable=False),
        sa.Column("entity_type", sa.String(50), nullable=False),
        sa.Column("principal_type", sa.String(10), nullable=False),
        sa.Column("principal_id", PGUUID(as_uuid=True), nullable=False),
        sa.Column("effect", sa.String(10), nullable=False, server_default=sa.text("'allow'")),
        sa.Column("conditions", JSONB, nullable=True),
        sa.Column("priority", sa.Integer, nullable=False, server_default=sa.text("0")),
        sa.Column("tenant_id", PGUUID(as_uuid=True), nullable=False),
        sa.Column("enabled", sa.Boolean, nullable=False, server_default=sa.text("true")),
        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.text("now()")),
        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.text("now()")),
        sa.CheckConstraint(
            "principal_type IN ('user', 'group', 'role')",
            name="ck_epol_principal_type",
        ),
        sa.CheckConstraint(
            "effect IN ('allow', 'deny')",
            name="ck_epol_effect",
        ),
    )
    op.execute('CREATE INDEX IF NOT EXISTS ix_epol_entity_type ON entity_policies (entity_type)')
    op.execute('CREATE INDEX IF NOT EXISTS ix_epol_principal ON entity_policies (principal_type, principal_id)')
    op.execute('CREATE INDEX IF NOT EXISTS ix_epol_tenant ON entity_policies (tenant_id)')
    op.execute('CREATE INDEX IF NOT EXISTS ix_epol_priority ON entity_policies (priority)')
    op.execute('CREATE INDEX IF NOT EXISTS ix_epol_enabled ON entity_policies (enabled)')


def downgrade() -> None:
    op.drop_index("ix_epol_enabled", table_name="entity_policies")
    op.drop_index("ix_epol_priority", table_name="entity_policies")
    op.drop_index("ix_epol_tenant", table_name="entity_policies")
    op.drop_index("ix_epol_principal", table_name="entity_policies")
    op.drop_index("ix_epol_entity_type", table_name="entity_policies")
    op.drop_table("entity_policies")