"""Seed a disabled Jamf Pro (MDM) integration placeholder.

Adds an empty, *disabled* ``kind='mdm' provider='jamf'`` row so the
Jamf connector shows up in /admin/integrations on first boot. The admin
fills in ``base_url`` + ``client_id`` + ``client_secret`` (generated in
Jamf → Settings → System → API Roles and Clients) and flips ``enabled``
on — the secret is encrypted at write-time by the integrations service,
never committed here.

Idempotent: INSERTed only if the slug isn't already taken.
"""
from __future__ import annotations

import uuid

import sqlalchemy as sa
from alembic import op


revision = "343"
down_revision = "342"
branch_labels = None
depends_on = None


_SLUG = "jamf-primary"


def upgrade() -> None:
    bind = op.get_bind()
    exists = bind.execute(
        sa.text("SELECT 1 FROM integrations WHERE slug = :s"),
        {"s": _SLUG},
    ).scalar()
    if exists:
        return
    bind.execute(
        sa.text(
            "INSERT INTO integrations "
            "(id, kind, provider, name, slug, description, "
            " enabled, is_primary, "
            " config_public, secrets_encrypted, secrets_nonce) "
            "VALUES "
            "(:id, 'mdm', 'jamf', :name, :slug, :desc, "
            " 0, 0, NULL, NULL, NULL)"
        ),
        {
            "id": str(uuid.uuid4()),
            "name": "Jamf Pro (MDM)",
            "slug": _SLUG,
            "desc": (
                "Jamf Pro Apple 设备管理。填 Jamf Pro URL + API Client "
                "ID/Secret 后启用;用于席位/设备清单与离职锁定/擦除。"
            ),
        },
    )


def downgrade() -> None:
    bind = op.get_bind()
    bind.execute(
        sa.text("DELETE FROM integrations WHERE slug = :s"),
        {"s": _SLUG},
    )