"""Enable RLS for 8 tables that need tenant isolation.

Tables excluded (no tenant_id column):
- outbox_deliveries: linked via event_outbox which has tenant_id
- marketplace_listings: global plugin marketplace, not tenant-specific

Revision ID: 0129
Revises: 0128
"""

from alembic import op

revision = "0129"
down_revision = "0128"
branch_labels = None
depends_on = None

TABLES_NEEDING_RLS = [
    "ai_decision_records",
    "approval_requests",
    "automation_agent_run_steps",
    "roles",
    "sequences",
    "wiki_articles",
    "wiki_article_versions",
    "wiki_categories",
]


def upgrade() -> None:
    for table in TABLES_NEEDING_RLS:
        op.execute(f"ALTER TABLE {table} ENABLE ROW LEVEL SECURITY;")
        op.execute(
            f"CREATE POLICY tenant_isolation ON {table} "
            f"FOR ALL USING (tenant_id = current_setting('app.tenant_id')::uuid);"
        )


def downgrade() -> None:
    for table in TABLES_NEEDING_RLS:
        op.execute(f"DROP POLICY IF EXISTS tenant_isolation ON {table};")
        op.execute(f"ALTER TABLE {table} DISABLE ROW LEVEL SECURITY;")