"""Fix guest invitation security — separate token table.

Revision ID: 0062
Revises: 0061
Create Date: 2026-07-29

Problems fixed:
1. Guest UUID was used as invitation token (P1.6)
2. No separate token with sufficient entropy
3. No one-time use tracking
4. No session revocation on guest deletion
"""

from alembic import op
import sqlalchemy as sa
from sqlalchemy.dialects.postgresql import UUID

revision = "0062"
down_revision = "0061"
branch_labels = None
depends_on = None


def upgrade() -> None:
    op.create_table(
        "guest_invitations",
        sa.Column("id", UUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
        sa.Column("guest_user_id", UUID(as_uuid=True), sa.ForeignKey("guest_users.id", ondelete="CASCADE"), nullable=False),
        sa.Column("token_hash", sa.String(64), nullable=False, unique=True, index=True),
        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
        sa.Column("used_at", sa.DateTime(timezone=True), nullable=True),
        sa.Column("revoked_at", sa.DateTime(timezone=True), nullable=True),
        sa.Column("created_by", UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
    )
    op.execute("ALTER TABLE guest_invitations ENABLE ROW LEVEL SECURITY")
    op.execute("""
        CREATE POLICY guest_invitations_tenant_isolation ON guest_invitations
        FOR ALL
        USING (
            EXISTS (
                SELECT 1 FROM guest_users gu
                WHERE gu.id = guest_invitations.guest_user_id
                AND gu.tenant_id = current_setting('app.current_tenant_id', true)::uuid
            )
        )
    """)


def downgrade() -> None:
    op.drop_table("guest_invitations")