"""add global credentials column to payment_providers

Adds credentials_enc (TEXT, nullable) to payment_providers table for
storing provider-level encrypted credentials shared by all merchants.
Seeds TSYS with credentials from environment variables if present.

Revision ID: global001_add_provider_global_credentials
Revises: tsys002_add_provider_transactions_table
Create Date: 2026-04-21

"""
from alembic import op
import sqlalchemy as sa
from sqlalchemy import text

revision = "global001_provider_global_creds"
down_revision = "tsys002_provider_transactions"
branch_labels = None
depends_on = None


def upgrade():
    op.add_column(
        "payment_providers",
        sa.Column("credentials_enc", sa.Text(), nullable=True),
    )

    # Seed TSYS global credentials from environment variables if all required
    # values are present — allows immediate payments without manual admin setup.
    _seed_tsys_from_env()


def downgrade():
    op.drop_column("payment_providers", "credentials_enc")


def _seed_tsys_from_env():
    import os
    import json

    merchant_id = os.environ.get("TSYS_MERCHANT_ID", "")
    device_id = os.environ.get("TSYS_DEVICE_ID", "")
    user_id = os.environ.get("TSYS_USER_ID", "")
    password = os.environ.get("TSYS_PASSWORD", "")
    developer_id = os.environ.get("TSYS_DEVELOPER_ID", "")
    api_base_url = os.environ.get("TSYS_API_BASE_URL", "")
    tsep_base_url = os.environ.get("TSYS_TSEP_BASE_URL", "")
    tsys_env = os.environ.get("TSYS_ENV", "test")
    webhook_secret = os.environ.get("TSYS_WEBHOOK_SECRET", "")
    credential_key = os.environ.get("CREDENTIAL_ENCRYPTION_KEY", "")

    if not all([merchant_id, device_id, user_id, password, credential_key]):
        return  # Required vars missing — skip seeding

    credentials = {
        "merchant_id": merchant_id,
        "device_id": device_id,
        "user_id": user_id,
        "password": password,
        "developer_id": developer_id,
        "api_base_url": api_base_url,
        "tsep_base_url": tsep_base_url,
        "tsys_env": tsys_env,
        "webhook_secret": webhook_secret,
    }

    # Encrypt the credentials dict
    try:
        from cryptography.fernet import Fernet
        f = Fernet(credential_key.encode() if isinstance(credential_key, str) else credential_key)
        encrypted = f.encrypt(json.dumps(credentials).encode()).decode()
    except Exception:
        return  # Bad key — skip seeding silently

    bind = op.get_bind()
    bind.execute(
        text(
            "UPDATE payment_providers SET credentials_enc = :enc WHERE slug = 'tsys' AND credentials_enc IS NULL"
        ),
        {"enc": encrypted},
    )