"""线索引擎与系统自审计表：clue / clue_status_history / working_paper / audit_log

Revision ID: 0002_clues_audit
Revises: 0001_init_datahub
Create Date: 2026-06
"""
from collections.abc import Sequence

import sqlalchemy as sa
from alembic import op
from sqlalchemy.dialects import postgresql

revision: str = "0002_clues_audit"
down_revision: str | None = "0001_init_datahub"
branch_labels: str | Sequence[str] | None = None
depends_on: str | Sequence[str] | None = None

confidence_tier = postgresql.ENUM(
    "high", "medium", "low", name="confidence_tier", create_type=False
)
clue_status = postgresql.ENUM(
    "new", "assigned", "reviewing", "confirmed", "dismissed",
    "rectifying", "transferred", "closed", name="clue_status", create_type=False,
)


def upgrade() -> None:
    bind = op.get_bind()
    confidence_tier.create(bind, checkfirst=True)
    clue_status.create(bind, checkfirst=True)

    op.create_table(
        "clue",
        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
        sa.Column("title", sa.String(256), nullable=False),
        sa.Column("risk_domain", sa.String(32), nullable=False),
        sa.Column("scenario_code", sa.String(32), nullable=False),
        sa.Column("confidence", confidence_tier, nullable=False),
        sa.Column("score", sa.Float(), nullable=False, server_default="0"),
        sa.Column("status", clue_status, nullable=False, server_default="new"),
        sa.Column("rationale", sa.Text(), nullable=False, server_default=""),
        sa.Column("evidence", postgresql.JSONB(), nullable=False, server_default="{}"),
        sa.Column("subjects", postgresql.JSONB(), nullable=False, server_default="{}"),
        sa.Column("amount_involved", sa.Float(), nullable=True),
        sa.Column("assignee", sa.String(64), nullable=True),
        sa.Column("feedback", sa.String(16), nullable=True),
        sa.Column("model_version", sa.String(64), nullable=True),
        sa.Column("rule_version", sa.String(64), nullable=True),
        sa.Column("data_version_id", postgresql.UUID(as_uuid=True), nullable=True),
        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False),
    )
    op.create_index("ix_clue_status", "clue", ["status"])
    op.create_index("ix_clue_scenario", "clue", ["scenario_code"])
    op.create_index("ix_clue_assignee", "clue", ["assignee"])

    op.create_table(
        "clue_status_history",
        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
        sa.Column("clue_id", postgresql.UUID(as_uuid=True), nullable=False),
        sa.Column("from_status", sa.String(16), nullable=True),
        sa.Column("to_status", sa.String(16), nullable=False),
        sa.Column("actor", sa.String(64), nullable=False),
        sa.Column("note", sa.Text(), nullable=True),
        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
        sa.ForeignKeyConstraint(["clue_id"], ["clue.id"]),
    )
    op.create_index("ix_csh_clue", "clue_status_history", ["clue_id"])

    op.create_table(
        "working_paper",
        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
        sa.Column("clue_id", postgresql.UUID(as_uuid=True), nullable=False),
        sa.Column("content", sa.Text(), nullable=False, server_default=""),
        sa.Column("conclusion", sa.String(32), nullable=True),
        sa.Column("author", sa.String(64), nullable=False),
        sa.Column("snapshot", postgresql.JSONB(), nullable=False, server_default="{}"),
        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
        sa.ForeignKeyConstraint(["clue_id"], ["clue.id"]),
    )
    op.create_index("ix_wp_clue", "working_paper", ["clue_id"])

    op.create_table(
        "audit_log",
        sa.Column("id", postgresql.UUID(as_uuid=True), primary_key=True),
        sa.Column("seq", sa.BigInteger(), sa.Identity(always=False), nullable=False),
        sa.Column("actor", sa.String(64), nullable=False),
        sa.Column("role", sa.String(32), nullable=True),
        sa.Column("action", sa.String(64), nullable=False),
        sa.Column("target_type", sa.String(64), nullable=True),
        sa.Column("target_id", sa.String(128), nullable=True),
        sa.Column("detail", postgresql.JSONB(), nullable=False, server_default="{}"),
        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
        sa.Column("prev_hash", sa.String(64), nullable=True),
        sa.Column("entry_hash", sa.String(64), nullable=False),
    )
    op.create_index("ix_audit_actor", "audit_log", ["actor"])
    op.create_index("ix_audit_action", "audit_log", ["action"])
    op.create_index("ix_audit_seq", "audit_log", ["seq"], unique=True)

    # R19：禁止物理删除线索与审计日志（数据库级触发器兜底）
    op.execute(
        """
        CREATE OR REPLACE FUNCTION forbid_delete() RETURNS trigger AS $$
        BEGIN
            RAISE EXCEPTION '禁止删除：% 表受 R19 不可删除约束保护', TG_TABLE_NAME;
        END;
        $$ LANGUAGE plpgsql;
        """
    )
    op.execute(
        "CREATE TRIGGER trg_clue_no_delete BEFORE DELETE ON clue "
        "FOR EACH ROW EXECUTE FUNCTION forbid_delete();"
    )
    op.execute(
        "CREATE TRIGGER trg_audit_no_delete BEFORE DELETE ON audit_log "
        "FOR EACH ROW EXECUTE FUNCTION forbid_delete();"
    )
    # 审计日志禁止更新（仅追加）
    op.execute(
        """
        CREATE OR REPLACE FUNCTION forbid_update() RETURNS trigger AS $$
        BEGIN
            RAISE EXCEPTION '禁止更新：% 表为仅追加日志', TG_TABLE_NAME;
        END;
        $$ LANGUAGE plpgsql;
        """
    )
    op.execute(
        "CREATE TRIGGER trg_audit_no_update BEFORE UPDATE ON audit_log "
        "FOR EACH ROW EXECUTE FUNCTION forbid_update();"
    )


def downgrade() -> None:
    op.execute("DROP TRIGGER IF EXISTS trg_audit_no_update ON audit_log;")
    op.execute("DROP TRIGGER IF EXISTS trg_audit_no_delete ON audit_log;")
    op.execute("DROP TRIGGER IF EXISTS trg_clue_no_delete ON clue;")
    op.drop_table("audit_log")
    op.drop_table("working_paper")
    op.drop_table("clue_status_history")
    op.drop_table("clue")
    clue_status.drop(op.get_bind(), checkfirst=True)
    confidence_tier.drop(op.get_bind(), checkfirst=True)
    op.execute("DROP FUNCTION IF EXISTS forbid_update();")
    op.execute("DROP FUNCTION IF EXISTS forbid_delete();")