package persistence

import (
	"context"
	"database/sql"
	"fmt"

	"github.com/nexuscrm/shared/pkg/constants"
)

// VerifyOAuthGrantSchemaReadiness proves the additive refresh-token grant
// binding is present before a runtime can issue or rotate a bound credential.
// The setup workflow reconciles this managed-table declaration before starting
// the server; startup treats a missing column as an admission failure rather
// than letting an OAuth request fail later with an unknown-column error.
func VerifyOAuthGrantSchemaReadiness(ctx context.Context, db *sql.DB) error {
	if err := VerifyRequiredTableColumns(ctx, db, constants.TableOAuthRefreshToken, map[string]string{
		constants.FieldSysOAuthRefreshToken_ConsentID: "varchar(255)",
	}); err != nil {
		return fmt.Errorf("OAuth authorization-grant schema readiness: %w", err)
	}
	return nil
}