"""Add admin_audit_logs table (Phase 6.2: admin audit logs)

Append-only trail of administrative actions. Raw IPs/user agents are never
stored — only salted SHA-256 hashes.

Revision ID: b2c4d6e8f0a1
Revises: a1b2c3d4e5f7
Create Date: 2026-07-04 00:00:00.000000

"""
from alembic import op
import sqlalchemy as sa


# revision identifiers, used by Alembic.
revision = "b2c4d6e8f0a1"
down_revision = "a1b2c3d4e5f7"
branch_labels = None
depends_on = None


def upgrade():
    op.create_table(
        "admin_audit_logs",
        sa.Column("admin_id", sa.BigInteger().with_variant(sa.Integer(), "sqlite"), nullable=False),
        sa.Column("action", sa.String(length=64), nullable=False),
        sa.Column("entity_type", sa.String(length=32), nullable=True),
        sa.Column("entity_public_id", sa.CHAR(length=36), nullable=True),
        sa.Column("entity_name", sa.String(length=255), nullable=True),
        sa.Column("details", sa.Text(), nullable=True),
        sa.Column("ip_hash", sa.CHAR(length=64), nullable=True),
        sa.Column("user_agent_hash", sa.CHAR(length=64), nullable=True),
        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
        sa.Column("id", sa.BigInteger().with_variant(sa.Integer(), "sqlite"), autoincrement=True, nullable=False),
        sa.ForeignKeyConstraint(["admin_id"], ["users.id"], name="fk_admin_audit_logs_admin_id"),
        sa.PrimaryKeyConstraint("id"),
    )
    with op.batch_alter_table("admin_audit_logs", schema=None) as batch_op:
        batch_op.create_index("ix_admin_audit_logs_admin_id", ["admin_id"], unique=False)
        batch_op.create_index("ix_admin_audit_logs_action", ["action"], unique=False)
        batch_op.create_index("ix_admin_audit_logs_entity_type", ["entity_type"], unique=False)
        batch_op.create_index("ix_admin_audit_logs_created_at", ["created_at"], unique=False)


def downgrade():
    op.drop_table("admin_audit_logs")