/**
 * field_permission_rules — field-level-permissions (wave-11 leaf-E).
 *
 * Per-tenant, per-role field visibility/editability rules.
 * UNIQUE(tenant_id, entity_type, field_name, role) + plain btree index
 * are both declared here via Drizzle (no partial/expression logic).
 * CHECK constraints are enforced in migration SQL.
 */
import { pgTable, uuid, text, timestamp, uniqueIndex, index } from 'drizzle-orm/pg-core'
import { tenants } from './tenants'

export const fieldPermissionRules = pgTable(
  'field_permission_rules',
  {
    id: uuid('id').primaryKey().defaultRandom(),
    tenantId: uuid('tenant_id')
      .notNull()
      .references(() => tenants.id, { onDelete: 'cascade' }),
    // CHECK (entity_type IN (...)) enforced in migration SQL
    entityType: text('entity_type').notNull(),
    fieldName: text('field_name').notNull(),
    role: text('role').notNull(),
    // CHECK (permission IN ('visible','read_only','hidden')) enforced in migration SQL
    permission: text('permission').notNull().default('visible'),
    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
  },
  (t) => ({
    tenantEntityUniq: uniqueIndex('idx_fpr_unique').on(
      t.tenantId,
      t.entityType,
      t.fieldName,
      t.role,
    ),
    tenantEntityIdx: index('idx_fpr_tenant').on(t.tenantId, t.entityType),
  }),
)

export type FieldPermissionRuleRow = typeof fieldPermissionRules.$inferSelect
export type NewFieldPermissionRule = typeof fieldPermissionRules.$inferInsert