"""Agent distribution: releases + secure enrollment.

agent_releases catalogs published builds of the universal Windows Agent
package (the binary itself lives in local release storage, never in
Postgres). agent_enrollments tracks one pending-or-completed installation
per row, carrying two distinct hashed, single-use, short-TTL secrets: a
download token (the shareable package link) and an enrollment token
(embedded in the downloaded bundle, consumed once by POST /v1/agents/enroll).
Neither secret is ever stored in plaintext.

Revision ID: 0022_agent_releases_enrollment
Revises: 0021_sso_federated_identity
"""
from alembic import op
import sqlalchemy as sa

revision = "0022_agent_releases_enrollment"
down_revision = "0021_sso_federated_identity"
branch_labels = None
depends_on = None


def upgrade():
    op.create_table(
        "agent_releases",
        sa.Column("id", sa.Integer(), primary_key=True),
        sa.Column("version", sa.String(32), nullable=False),
        sa.Column("platform", sa.String(16), nullable=False, server_default="windows"),
        sa.Column("architecture", sa.String(16), nullable=False, server_default="x64"),
        sa.Column("filename", sa.String(255), nullable=False),
        sa.Column("size_bytes", sa.Integer(), nullable=False),
        sa.Column("sha256", sa.String(64), nullable=False),
        sa.Column("storage_path", sa.String(512), nullable=False),
        sa.Column("status", sa.String(16), nullable=False, server_default="DRAFT"),
        sa.Column("release_notes", sa.Text(), nullable=True),
        sa.Column("created_by", sa.Integer(), sa.ForeignKey("admin_users.id"), nullable=True),
        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
        sa.Column("published_at", sa.DateTime(timezone=True), nullable=True),
        sa.UniqueConstraint("version", "platform", "architecture", name="uq_agent_release_version"),
    )
    op.create_index("ix_agent_releases_version", "agent_releases", ["version"])
    op.create_index("ix_agent_releases_sha256", "agent_releases", ["sha256"])
    op.create_index("ix_agent_releases_status", "agent_releases", ["status"])

    op.create_table(
        "agent_enrollments",
        sa.Column("id", sa.Integer(), primary_key=True),
        sa.Column("enrollment_uuid", sa.String(36), nullable=False),
        sa.Column("tenant_id", sa.Integer(), sa.ForeignKey("tenants.id"), nullable=False),
        sa.Column("display_name", sa.String(160), nullable=False),
        sa.Column("expected_hostname", sa.String(255), nullable=True),
        sa.Column("release_id", sa.Integer(), sa.ForeignKey("agent_releases.id"), nullable=False),
        sa.Column("status", sa.String(16), nullable=False, server_default="PENDING"),
        sa.Column("created_by", sa.Integer(), sa.ForeignKey("admin_users.id"), nullable=True),
        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
        sa.Column("download_token_hash", sa.String(64), nullable=True),
        sa.Column("download_token_expires_at", sa.DateTime(timezone=True), nullable=True),
        sa.Column("download_max_uses", sa.Integer(), nullable=False, server_default="1"),
        sa.Column("download_uses", sa.Integer(), nullable=False, server_default="0"),
        sa.Column("downloaded_at", sa.DateTime(timezone=True), nullable=True),
        sa.Column("enrollment_token_hash", sa.String(64), nullable=True),
        sa.Column("enrollment_token_expires_at", sa.DateTime(timezone=True), nullable=True),
        sa.Column("enrollment_used_at", sa.DateTime(timezone=True), nullable=True),
        sa.Column("machine_fingerprint_seen", sa.String(128), nullable=True),
        sa.Column("hostname_seen", sa.String(255), nullable=True),
        sa.Column("hostname_mismatch", sa.Boolean(), nullable=False, server_default="false"),
        sa.Column("agent_id", sa.Integer(), sa.ForeignKey("agents.id"), nullable=True),
        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
        sa.UniqueConstraint("enrollment_uuid", name="uq_agent_enrollment_uuid"),
    )
    op.create_index("ix_agent_enrollments_uuid", "agent_enrollments", ["enrollment_uuid"])
    op.create_index("ix_agent_enrollments_tenant", "agent_enrollments", ["tenant_id"])
    op.create_index("ix_agent_enrollments_release", "agent_enrollments", ["release_id"])
    op.create_index("ix_agent_enrollments_status", "agent_enrollments", ["status"])
    op.create_index("ix_agent_enrollments_agent", "agent_enrollments", ["agent_id"])


def downgrade():
    op.drop_index("ix_agent_enrollments_agent", table_name="agent_enrollments")
    op.drop_index("ix_agent_enrollments_status", table_name="agent_enrollments")
    op.drop_index("ix_agent_enrollments_release", table_name="agent_enrollments")
    op.drop_index("ix_agent_enrollments_tenant", table_name="agent_enrollments")
    op.drop_index("ix_agent_enrollments_uuid", table_name="agent_enrollments")
    op.drop_table("agent_enrollments")
    op.drop_index("ix_agent_releases_status", table_name="agent_releases")
    op.drop_index("ix_agent_releases_sha256", table_name="agent_releases")
    op.drop_index("ix_agent_releases_version", table_name="agent_releases")
    op.drop_table("agent_releases")