"""Persist service-account identities used by control-plane credentials."""

from __future__ import annotations

import sqlalchemy as sa
from alembic import op

revision = "0006_service_accounts"
down_revision = "0005_audit_events"
branch_labels = None
depends_on = None


def upgrade() -> None:
    """Create workspace-bound service-account identities."""

    op.create_table(
        "service_accounts",
        sa.Column("id", sa.Uuid(), primary_key=True),
        sa.Column("workspace_id", sa.Uuid(), nullable=False),
        sa.Column("application_id", sa.Uuid(), nullable=False),
        sa.Column("name", sa.String(120), nullable=False),
        sa.Column("scopes", sa.JSON(), nullable=False),
        sa.Column("active", sa.Boolean(), nullable=False, server_default=sa.true()),
        sa.Column(
            "created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()
        ),
        sa.ForeignKeyConstraint(
            ["application_id", "workspace_id"],
            ["control.applications.id", "control.applications.workspace_id"],
            ondelete="CASCADE",
        ),
        sa.UniqueConstraint("id", "workspace_id", name="uq_service_accounts_id_workspace"),
        schema="control",
    )


def downgrade() -> None:
    """Remove service-account identities without affecting credential history."""

    op.drop_table("service_accounts", schema="control")