"""Fix DB roles — add default privileges and grants for all tables.

Revision ID: 0061
Revises: 0060
Create Date: 2026-07-29

Problems fixed:
1. crm_runtime role has no grants on tables created after migration 0044
2. No ALTER DEFAULT PRIVILEGES for future tables
3. Auth tables (users, tenants, user_tenants, user_groups) need SELECT grants
4. New permission/guest/policy tables need grants
"""

from alembic import op

revision = "0061"
down_revision = "0060"
branch_labels = None
depends_on = None


def upgrade() -> None:
    # Grant privileges on all existing tables to crm_runtime
    op.execute("GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO crm_runtime")
    
    # Grant USAGE on sequences
    op.execute("GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO crm_runtime")
    
    # Default privileges for future tables created by migration owner
    op.execute("ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO crm_runtime")
    op.execute("ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO crm_runtime")
    
    # Ensure RLS is enabled on all tenant tables that have tenant_id
    # (covers tables created after migration 0044 that missed RLS)
    tenant_tables = [
        "entity_permissions",
        "entity_policies",
        "permission_templates",
        "guest_users",
        "contact_folder_permissions",
    ]
    for table in tenant_tables:
        op.execute(f"ALTER TABLE {table} ENABLE ROW LEVEL SECURITY")
        # Create tenant isolation policy if not exists
        op.execute(f"""
            DO $$
            BEGIN
                IF NOT EXISTS (
                    SELECT 1 FROM pg_policy 
                    WHERE polname = '{table}_tenant_isolation' 
                    AND polrelid = '{table}'::regclass
                ) THEN
                    CREATE POLICY {table}_tenant_isolation ON {table}
                    FOR ALL
                    USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid)
                    WITH CHECK (tenant_id = current_setting('app.current_tenant_id', true)::uuid);
                END IF;
            END $$;
        """)


def downgrade() -> None:
    # Revoke default privileges
    op.execute("ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE SELECT, INSERT, UPDATE, DELETE ON TABLES FROM crm_runtime")
    op.execute("ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE USAGE, SELECT ON SEQUENCES FROM crm_runtime")