"""Production cloud-account write lock — default LOCKED (opt-in to write).

Revision ID: 246
Revises: 245
Create Date: 2026-06-03

Why this exists
---------------
Writes against a production cloud account reach the real provider IAM —
adding a member, releasing a role, transferring ownership, decommission.
A role was released against a production account in error, so we add a
single global kill-switch: while engaged, NO ONE (employee / scope owner
/ cloud_admin / global_admin / it_admin) may mutate a ``environment=prod``
cloud scope.

The switch is the platform setting ``cmdb.prod_cloud_writes_enabled``,
seeded ``false`` so the lock is engaged by default — a production write
is opt-in, not opt-out. The enforcement code
(``app/domains/cmdb/prod_write_lock.py``) treats a missing row as locked
too, so the seed is for admin-UI discoverability; the safe default does
not depend on this row existing.

Idempotency
-----------
``INSERT ... ON DUPLICATE KEY UPDATE description`` so re-running refreshes
the description without overwriting an admin's flipped value.
"""
from __future__ import annotations

import json

import sqlalchemy as sa

from alembic import op

revision = "246"
down_revision = "245"
branch_labels = None
depends_on = None


SETTING_KEY = "cmdb.prod_cloud_writes_enabled"
DEFAULT_VALUE = False
DESCRIPTION = (
    "生产云账号写操作总开关。false(默认)= 锁定:任何人(员工 / 子账号 "
    "owner / 云管理员 / IT 管理员)都不能对 environment=prod 的云账号执行"
    "加人 / 释放角色 / 续期 / 转移 owner / 改配置 / 关停 等写操作。"
    "确需变更时临时改 true,操作完成后立即改回 false。系统自动化"
    "(离职回收 / TTL 过期清理)不受此开关影响。"
)


def _table_exists(bind, name: str) -> bool:
    return bind.execute(
        sa.text(
            "SELECT 1 FROM information_schema.TABLES "
            "WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = :n"
        ),
        {"n": name},
    ).scalar() is not None


def upgrade() -> None:
    bind = op.get_bind()
    if not _table_exists(bind, "platform_settings"):
        return
    bind.execute(
        sa.text(
            "INSERT INTO platform_settings (`key`, value, description, "
            "created_at, updated_at) "
            "VALUES (:k, :v, :d, NOW(), NOW()) "
            "ON DUPLICATE KEY UPDATE "
            "description = VALUES(description), updated_at = NOW()"
        ),
        {
            "k": SETTING_KEY,
            "v": json.dumps(DEFAULT_VALUE),
            "d": DESCRIPTION,
        },
    )


def downgrade() -> None:
    bind = op.get_bind()
    if not _table_exists(bind, "platform_settings"):
        return
    bind.execute(
        sa.text("DELETE FROM platform_settings WHERE `key` = :k"),
        {"k": SETTING_KEY},
    )