-- 10. 加密密钥：信封加密，删除时销毁（架构 §3.11，DM4）
-- 来源：docs/architecture/schema-draft.sql（2026-11-03 验证过的草案）
CREATE TABLE data_key (
  id            uuid PRIMARY KEY,
  tenant_id     uuid NOT NULL REFERENCES tenant (id),
  scope         text NOT NULL CHECK (scope IN ('tenant', 'project')),
  project_id    uuid,                                   -- 不加外键：项目删除后这行留下销毁记录
  wrapped_key   bytea,                                  -- 被 KMS 主密钥加密的数据密钥；销毁时置空
  kek_ref       text NOT NULL,
  created_at    timestamptz NOT NULL DEFAULT now(),
  destroyed_at  timestamptz,
  CHECK ((scope = 'project') = (project_id IS NOT NULL)),
  CHECK ((destroyed_at IS NULL) = (wrapped_key IS NOT NULL))
);
CREATE UNIQUE INDEX ON data_key (tenant_id) WHERE scope = 'tenant' AND destroyed_at IS NULL;
CREATE UNIQUE INDEX ON data_key (tenant_id, project_id) WHERE scope = 'project' AND destroyed_at IS NULL;