"""RTC auto-apply: per-installation authorization (default OFF) + immutable write audit.

Revision ID: 0027_rtc_auto_apply
Revises: 0026_central_processing_control
"""
from alembic import op
import sqlalchemy as sa

revision = "0027_rtc_auto_apply"
down_revision = "0026_central_processing_control"
branch_labels = None
depends_on = None


def upgrade():
    op.add_column("installations", sa.Column("rtc_auto_apply_authorized", sa.Boolean(), nullable=False, server_default="false"))
    op.create_table(
        "rtc_write_audits",
        sa.Column("id", sa.Integer(), primary_key=True),
        sa.Column("tenant_id", sa.Integer(), sa.ForeignKey("tenants.id"), nullable=False, index=True),
        sa.Column("installation_id", sa.Integer(), sa.ForeignKey("installations.id"), nullable=False, index=True),
        sa.Column("agent_id", sa.Integer(), sa.ForeignKey("agents.id"), nullable=False, index=True),
        sa.Column("job_id", sa.Integer(), nullable=True, index=True),
        sa.Column("client", sa.String(255), nullable=True),
        sa.Column("product_code", sa.String(64), nullable=False, index=True),
        sa.Column("field", sa.String(32), nullable=False),
        sa.Column("outcome", sa.String(16), nullable=False, index=True),
        sa.Column("reason", sa.String(96), nullable=True),
        sa.Column("old_value", sa.String(64), nullable=True),
        sa.Column("new_value", sa.String(64), nullable=True),
        sa.Column("rule_id", sa.String(32), nullable=True),
        sa.Column("evidence", sa.JSON(), nullable=False, server_default="{}"),
        sa.Column("official_source_version", sa.JSON(), nullable=False, server_default="{}"),
        sa.Column("local_catalog_hash", sa.String(64), nullable=True),
        sa.Column("written_at", sa.String(40), nullable=True),
        sa.Column("recorded_at", sa.DateTime(timezone=True), server_default=sa.func.now(), index=True),
    )


def downgrade():
    op.drop_table("rtc_write_audits")
    op.drop_column("installations", "rtc_auto_apply_authorized")