-- ADR-0024: Organization-scoped provider connections and immutable encrypted
-- credential versions. No provider plaintext column exists in this schema.

CREATE TYPE "ProviderCredentialMode" AS ENUM ('BYOK', 'PLATFORM_MANAGED');
CREATE TYPE "OrganizationConnectionStatus" AS ENUM ('DRAFT', 'ACTIVE', 'DISABLED');

CREATE TABLE "OrganizationProviderConnection" (
    "id" TEXT NOT NULL,
    "organizationId" TEXT NOT NULL,
    "providerId" TEXT NOT NULL,
    "mode" "ProviderCredentialMode" NOT NULL,
    "status" "OrganizationConnectionStatus" NOT NULL DEFAULT 'DRAFT',
    "activeSecretVersionId" TEXT,
    "activatedAt" TIMESTAMP(3),
    "disabledAt" TIMESTAMP(3),
    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
    "updatedAt" TIMESTAMP(3) NOT NULL,
    CONSTRAINT "OrganizationProviderConnection_pkey" PRIMARY KEY ("id")
);

CREATE TABLE "ProviderCredentialVersion" (
    "id" TEXT NOT NULL,
    "connectionId" TEXT NOT NULL,
    "version" INTEGER NOT NULL,
    "envelopeVersion" INTEGER NOT NULL DEFAULT 1,
    "keyId" TEXT NOT NULL,
    "envelope" JSONB NOT NULL,
    "createdByUserId" TEXT,
    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
    "retiredAt" TIMESTAMP(3),
    CONSTRAINT "ProviderCredentialVersion_pkey" PRIMARY KEY ("id")
);

CREATE UNIQUE INDEX "OrganizationProviderConnection_organizationId_providerId_key"
  ON "OrganizationProviderConnection"("organizationId", "providerId");
CREATE UNIQUE INDEX "OrganizationProviderConnection_activeSecretVersionId_key"
  ON "OrganizationProviderConnection"("activeSecretVersionId");
CREATE INDEX "OrganizationProviderConnection_organizationId_status_idx"
  ON "OrganizationProviderConnection"("organizationId", "status");
CREATE INDEX "OrganizationProviderConnection_providerId_status_idx"
  ON "OrganizationProviderConnection"("providerId", "status");

CREATE UNIQUE INDEX "ProviderCredentialVersion_connectionId_version_key"
  ON "ProviderCredentialVersion"("connectionId", "version");
CREATE INDEX "ProviderCredentialVersion_connectionId_retiredAt_idx"
  ON "ProviderCredentialVersion"("connectionId", "retiredAt");
CREATE INDEX "ProviderCredentialVersion_keyId_idx"
  ON "ProviderCredentialVersion"("keyId");
CREATE INDEX "ProviderCredentialVersion_createdByUserId_idx"
  ON "ProviderCredentialVersion"("createdByUserId");

ALTER TABLE "OrganizationProviderConnection"
  ADD CONSTRAINT "OrganizationProviderConnection_organizationId_fkey"
  FOREIGN KEY ("organizationId") REFERENCES "Organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;
ALTER TABLE "ProviderCredentialVersion"
  ADD CONSTRAINT "ProviderCredentialVersion_connectionId_fkey"
  FOREIGN KEY ("connectionId") REFERENCES "OrganizationProviderConnection"("id") ON DELETE CASCADE ON UPDATE CASCADE;
ALTER TABLE "ProviderCredentialVersion"
  ADD CONSTRAINT "ProviderCredentialVersion_createdByUserId_fkey"
  FOREIGN KEY ("createdByUserId") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;
ALTER TABLE "OrganizationProviderConnection"
  ADD CONSTRAINT "OrganizationProviderConnection_activeSecretVersionId_fkey"
  FOREIGN KEY ("activeSecretVersionId") REFERENCES "ProviderCredentialVersion"("id") ON DELETE RESTRICT ON UPDATE CASCADE;

ALTER TABLE "AuditEntry" ADD COLUMN "organizationId" TEXT;
ALTER TABLE "AuditEntry"
  ADD CONSTRAINT "AuditEntry_organizationId_fkey"
  FOREIGN KEY ("organizationId") REFERENCES "Organization"("id") ON DELETE SET NULL ON UPDATE CASCADE;
CREATE INDEX "AuditEntry_organizationId_createdAt_idx"
  ON "AuditEntry"("organizationId", "createdAt");
