"""Restrict DELETE grants on sensitive tables.

Removes DELETE privilege from crm_api and crm_worker on:
api_tokens, audit_log, notification_types, password_reset_tokens,
plugin_allowlist, plugin_migrations, plugins, sessions,
tenant_plugin_activation, tenants, user_tenants, users.

crm_auth keeps DELETE on sessions + password_reset_tokens (for logout/reset).

Revision ID: 0100
"""

from alembic import op

revision = "0100"
down_revision = "0099"
branch_labels = None
depends_on = None

# Tables where DELETE must be removed from crm_api and crm_worker
SENSITIVE_TABLES = [
    "api_tokens",
    "audit_log",
    "notification_types",
    "password_reset_tokens",
    "plugin_allowlist",
    "plugin_migrations",
    "plugins",
    "sessions",
    "tenant_plugin_activation",
    "tenants",
    "user_tenants",
    "users",
]


def upgrade() -> None:
    for table in SENSITIVE_TABLES:
        op.execute(f"REVOKE DELETE ON TABLE {table} FROM crm_api;")
        op.execute(f"REVOKE DELETE ON TABLE {table} FROM crm_worker;")


def downgrade() -> None:
    for table in SENSITIVE_TABLES:
        op.execute(f"GRANT DELETE ON TABLE {table} TO crm_api;")
        op.execute(f"GRANT DELETE ON TABLE {table} TO crm_worker;")