"""Create entity_attachments table — references DMS files.

Instead of storing files in a separate attachment storage path,
all files go through the DMS (files table) and entity_attachments
just references the DMS file with entity_type/entity_id.

This unifies the storage layer: one upload path, one download path,
one permission model, one deduplication (content_hash).

Revision ID: 0071
Revises: 0070
"""

from alembic import op
import sqlalchemy as sa
from sqlalchemy.dialects.postgresql import UUID as PGUUID

revision = "0071"
down_revision = "0070"
branch_labels = None
depends_on = None


def upgrade() -> None:
    op.create_table(
        "entity_attachments",
        sa.Column("id", PGUUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
        sa.Column("tenant_id", PGUUID(as_uuid=True), sa.ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False),
        sa.Column("entity_type", sa.String(50), nullable=False),
        sa.Column("entity_id", PGUUID(as_uuid=True), nullable=False),
        sa.Column("dms_file_id", PGUUID(as_uuid=True), sa.ForeignKey("files.id", ondelete="RESTRICT"), nullable=False),
        sa.Column("category", sa.String(50), nullable=True),
        sa.Column("display_name", sa.String(255), nullable=True),
        sa.Column("owner_id", PGUUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
        sa.Column("created_by", PGUUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
        sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
    )
    
    op.create_index("ix_entity_attachments_entity", "entity_attachments", ["entity_type", "entity_id", "tenant_id"])
    op.create_index("ix_entity_attachments_tenant", "entity_attachments", ["tenant_id"])
    op.create_index("ix_entity_attachments_dms_file", "entity_attachments", ["dms_file_id"])
    op.create_index("ix_entity_attachments_owner", "entity_attachments", ["owner_id"])
    
    # Enable RLS on entity_attachments (tenant isolation)
    op.execute("ALTER TABLE entity_attachments ENABLE ROW LEVEL SECURITY")
    op.execute(
        "CREATE POLICY entity_attachments_tenant_isolation ON entity_attachments "
        "FOR ALL "
        "USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid) "
        "WITH CHECK (tenant_id = current_setting('app.current_tenant_id', true)::uuid)"
    )
    
    # Grant to crm_api and crm_worker
    op.execute("GRANT SELECT, INSERT, UPDATE, DELETE ON entity_attachments TO crm_api, crm_worker")
    op.execute("GRANT USAGE ON SCHEMA public TO crm_api, crm_worker")


def downgrade() -> None:
    op.execute("DROP POLICY IF EXISTS entity_attachments_tenant_isolation ON entity_attachments")
    op.drop_table("entity_attachments")