"""add route interface security profile

Revision ID: d3f62e716ad4
Revises: b41f876a08c2
Create Date: 2026-08-10 12:00:00.000000
"""

from collections.abc import Sequence

import sqlalchemy as sa
from alembic import op

revision: str = "d3f62e716ad4"
down_revision: str | None = "b41f876a08c2"
branch_labels: str | Sequence[str] | None = None
depends_on: str | Sequence[str] | None = None


def upgrade() -> None:
    op.add_column(
        "invocation_route_projection_state",
        sa.Column("exposure", sa.String(length=32), nullable=True),
    )
    op.add_column(
        "invocation_route_projection_state",
        sa.Column("authorization", sa.String(length=64), nullable=True),
    )

    route_projection_state = sa.table(
        "invocation_route_projection_state",
        sa.column("exposure", sa.String(length=32)),
        sa.column("authorization", sa.String(length=64)),
        sa.column("validation_outcome", sa.String(length=32)),
    )
    op.execute(
        route_projection_state.update()
        .where(route_projection_state.c.validation_outcome == op.inline_literal("accepted"))
        .values(
            exposure=op.inline_literal("public_gateway"),
            authorization=op.inline_literal("platform_oidc_spicedb"),
        )
    )


def downgrade() -> None:
    op.drop_column("invocation_route_projection_state", "authorization")
    op.drop_column("invocation_route_projection_state", "exposure")