"""Disable RLS on system identity tables to fix login bootstrap circle.

Revision ID: 0067
Revises: 0066
Create Date: 2026-07-29

Problem: users, user_tenants, groups, roles have RLS enabled. The login
process needs to query these tables BEFORE a tenant context is set
(bootstrap circle: Login → Membership → Tenant-Context → Login).

RLS on these tables blocks login because there's no tenant context yet.

Solution: Disable RLS on system identity tables. Tenant isolation for
these tables is enforced at the application level (auth_service always
filters by user_id + tenant_id in queries).
"""

from alembic import op

revision = "0067"
down_revision = "0066"
branch_labels = None
depends_on = None

# System identity tables — no RLS (needed for login bootstrap)
SYSTEM_TABLES = [
    "users",
    "user_tenants",
    "groups",
    "user_groups",
    "roles",
]


def upgrade() -> None:
    for table in SYSTEM_TABLES:
        # Drop any existing policies
        op.execute(f"""
            DO $$
            DECLARE pol RECORD;
            BEGIN
                FOR pol IN
                    SELECT polname FROM pg_policy
                    WHERE polrelid = '{table}'::regclass
                LOOP
                    EXECUTE format('DROP POLICY IF EXISTS %I ON {table}', pol.polname);
                END LOOP;
            END $$;
        """)
        # Disable RLS
        op.execute(f"ALTER TABLE {table} DISABLE ROW LEVEL SECURITY")


def downgrade() -> None:
    for table in SYSTEM_TABLES:
        op.execute(f"ALTER TABLE {table} ENABLE ROW LEVEL SECURITY")