"""运营后台的数据库权限（决策 M6-2）：

- bd_ops（部署脚本建，LOGIN BYPASSRLS）：跨企业只读全部业务表；运营账号和会话表可写；能写审计（查看企业详情也留痕）。
  对某个企业做的修改（开通、退回、开票、调额度）仍走 bd_app + 租户事务，行级安全策略照样生效；
- 运营账号和会话表只给 bd_ops：用户端的 api / worker（bd_app）读不到。

Revision ID: 0011
"""

from __future__ import annotations

from alembic import op

revision = "0011"
down_revision = "0010"


def upgrade() -> None:
    op.get_bind().exec_driver_sql("""
GRANT USAGE ON SCHEMA app TO bd_ops;
GRANT SELECT ON ALL TABLES IN SCHEMA app TO bd_ops;
ALTER DEFAULT PRIVILEGES IN SCHEMA app GRANT SELECT ON TABLES TO bd_ops;
GRANT INSERT, UPDATE ON ops_admin, ops_session TO bd_ops;
GRANT INSERT ON audit_event TO bd_ops;
REVOKE ALL ON ops_admin, ops_session FROM bd_app;
""")


def downgrade() -> None:
    op.get_bind().exec_driver_sql("""
GRANT SELECT, INSERT, UPDATE, DELETE ON ops_admin, ops_session TO bd_app;
REVOKE INSERT ON audit_event FROM bd_ops;
REVOKE INSERT, UPDATE ON ops_admin, ops_session FROM bd_ops;
ALTER DEFAULT PRIVILEGES IN SCHEMA app REVOKE SELECT ON TABLES FROM bd_ops;
REVOKE SELECT ON ALL TABLES IN SCHEMA app FROM bd_ops;
REVOKE USAGE ON SCHEMA app FROM bd_ops;
""")