"""add opaque bearer authentication sessions

Revision ID: 20260713_0002
Revises: 20260713_0001
Create Date: 2026-07-13 14:20:00
"""

from collections.abc import Sequence

import sqlalchemy as sa

from alembic import op

revision: str = "20260713_0002"
down_revision: str | None = "20260713_0001"
branch_labels: str | Sequence[str] | None = None
depends_on: str | Sequence[str] | None = None


def upgrade() -> None:
    op.create_table(
        "auth_sessions",
        sa.Column("id", sa.String(length=36), nullable=False),
        sa.Column("token_hash", sa.String(length=64), nullable=False),
        sa.Column("tenant_id", sa.String(length=64), nullable=False),
        sa.Column("principal_type", sa.String(length=20), nullable=False),
        sa.Column("employee_id", sa.String(length=36), nullable=True),
        sa.Column("username", sa.String(length=255), nullable=False),
        sa.Column("metric_session_id", sa.String(length=64), nullable=False),
        sa.Column(
            "issued_at",
            sa.DateTime(timezone=True),
            server_default=sa.func.now(),
            nullable=False,
        ),
        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=False),
        sa.Column("revoked_at", sa.DateTime(timezone=True), nullable=True),
        sa.Column(
            "last_seen_at",
            sa.DateTime(timezone=True),
            server_default=sa.func.now(),
            nullable=False,
        ),
        sa.Column(
            "created_at",
            sa.DateTime(timezone=True),
            server_default=sa.func.now(),
            nullable=False,
        ),
        sa.PrimaryKeyConstraint("id"),
        sa.UniqueConstraint("token_hash", name="uq_auth_sessions_token_hash"),
    )
    op.create_index("ix_auth_sessions_tenant_id", "auth_sessions", ["tenant_id"])
    op.create_index("ix_auth_sessions_principal_type", "auth_sessions", ["principal_type"])
    op.create_index("ix_auth_sessions_employee_id", "auth_sessions", ["employee_id"])
    op.create_index("ix_auth_sessions_username", "auth_sessions", ["username"])
    op.create_index("ix_auth_sessions_metric_session_id", "auth_sessions", ["metric_session_id"])
    op.create_index("ix_auth_sessions_expires_at", "auth_sessions", ["expires_at"])
    op.create_index("ix_auth_sessions_revoked_at", "auth_sessions", ["revoked_at"])
    op.create_index(
        "ix_auth_sessions_principal_active",
        "auth_sessions",
        ["principal_type", "revoked_at", "expires_at"],
    )
    op.create_index(
        "ix_auth_sessions_tenant_username",
        "auth_sessions",
        ["tenant_id", "username"],
    )


def downgrade() -> None:
    op.drop_index("ix_auth_sessions_tenant_username", table_name="auth_sessions")
    op.drop_index("ix_auth_sessions_principal_active", table_name="auth_sessions")
    op.drop_index("ix_auth_sessions_revoked_at", table_name="auth_sessions")
    op.drop_index("ix_auth_sessions_expires_at", table_name="auth_sessions")
    op.drop_index("ix_auth_sessions_metric_session_id", table_name="auth_sessions")
    op.drop_index("ix_auth_sessions_username", table_name="auth_sessions")
    op.drop_index("ix_auth_sessions_employee_id", table_name="auth_sessions")
    op.drop_index("ix_auth_sessions_principal_type", table_name="auth_sessions")
    op.drop_index("ix_auth_sessions_tenant_id", table_name="auth_sessions")
    op.drop_table("auth_sessions")