"""Fix RLS policies — app.tenant_id → app.current_tenant_id.

8 RLS policies in production reference 'app.tenant_id' which doesn't exist
as a PostgreSQL parameter. The code uses 'app.current_tenant_id'.
This causes 500 errors on roles, sequences, wiki, approval_requests,
ai_decision_records, and automation_agent_run_steps.

Revision ID: 0136
Revises: 0135
Create Date: 2026-08-21
"""
from alembic import op

revision = "0136"
down_revision = "0135"
branch_labels = None
depends_on = None

# All 8 tables with broken RLS policies referencing app.tenant_id
TABLES_WITH_BAD_RLS = [
    "ai_decision_records",
    "approval_requests",
    "automation_agent_run_steps",
    "roles",
    "sequences",
    "wiki_articles",
    "wiki_article_versions",
    "wiki_categories",
]


def upgrade() -> None:
    for table in TABLES_WITH_BAD_RLS:
        # Drop old policy with app.tenant_id
        op.execute(f"DROP POLICY IF EXISTS tenant_isolation ON {table};")
        # Create new policy with app.current_tenant_id
        op.execute(
            f"CREATE POLICY tenant_isolation ON {table} "
            f"USING (tenant_id::text = current_setting('app.current_tenant_id', true));"
        )


def downgrade() -> None:
    for table in TABLES_WITH_BAD_RLS:
        op.execute(f"DROP POLICY IF EXISTS tenant_isolation ON {table};")
        op.execute(
            f"CREATE POLICY tenant_isolation ON {table} "
            f"USING (tenant_id::text = current_setting('app.tenant_id', true));"
        )