"""tsys005 - Mark user_id/password as ephemeral in TSYS onboarding_schema

PRD-HWMP-005: the schema-driven onboarding form (FR-4/FR-6) needs an explicit
`ephemeral: true` flag per field so the frontend renderer knows which fields
must never be pre-filled/persisted client-side. The V2 schema seeded by
tsys004 only described this in help_text prose, not as a machine-readable
flag. This is a data-only UPDATE of the existing `onboarding_schema` JSON —
no column/schema migration is needed.

Revision ID: tsys005_mark_ephemeral
Revises: 42e8f4f1899a
Create Date: 2026-07-14
"""
from typing import Union, Sequence
import json
import sqlalchemy as sa
from alembic import op

revision: str = 'tsys005_mark_ephemeral'
down_revision: Union[str, Sequence[str], None] = '42e8f4f1899a'
branch_labels = None
depends_on = None

TSYS_SCHEMA_V2_EPHEMERAL = {
    "fields": [
        {"key": "merchant_id", "label": "TSYS Merchant ID", "type": "text", "required": True, "help_text": "Your TSYS MID"},
        {"key": "device_id", "label": "Device ID", "type": "text", "required": True, "help_text": "24-character TSYS device identifier"},
        {"key": "developer_id", "label": "Developer ID", "type": "text", "required": True, "help_text": "TSYS Developer ID"},
        {"key": "user_id", "label": "User ID", "type": "text", "required": True, "help_text": "TransIT MultiPASS user ID — ephemeral, never stored", "ephemeral": True},
        {"key": "password", "label": "Password", "type": "password", "required": True, "help_text": "TSYS account password — ephemeral, never stored", "ephemeral": True},
    ]
}

TSYS_SCHEMA_V2 = {
    "fields": [
        {"key": "merchant_id", "label": "TSYS Merchant ID", "type": "text", "required": True, "help_text": "Your TSYS MID"},
        {"key": "device_id", "label": "Device ID", "type": "text", "required": True, "help_text": "24-character TSYS device identifier"},
        {"key": "developer_id", "label": "Developer ID", "type": "text", "required": True, "help_text": "TSYS Developer ID"},
        {"key": "user_id", "label": "User ID", "type": "text", "required": True, "help_text": "TransIT MultiPASS user ID — ephemeral, never stored"},
        {"key": "password", "label": "Password", "type": "password", "required": True, "help_text": "TSYS account password — ephemeral, never stored"},
    ]
}


def upgrade() -> None:
    conn = op.get_bind()
    conn.execute(
        sa.text("UPDATE payment_providers SET onboarding_schema = :schema WHERE slug = 'tsys' AND deleted_at IS NULL"),
        {"schema": json.dumps(TSYS_SCHEMA_V2_EPHEMERAL)},
    )


def downgrade() -> None:
    conn = op.get_bind()
    conn.execute(
        sa.text("UPDATE payment_providers SET onboarding_schema = :schema WHERE slug = 'tsys' AND deleted_at IS NULL"),
        {"schema": json.dumps(TSYS_SCHEMA_V2)},
    )