"""admin level gains projects.delete and project.members

M3 introduces finer permissions (`scout.projects.delete`,
`scout.project.members`). The seeded `admin` level should hold both — the seed
in constants.py already does for fresh databases; this backfills the live row.

Append-only and idempotent: it adds the two names if absent and never removes
anything, so a level rian has already edited by hand keeps his changes.

Revision ID: 0005_full_suite_permissions
Revises: 0004_staff_grants_not_demoting
Create Date: 2026-08-18
"""

from collections.abc import Sequence

from alembic import op

revision: str = "0005_full_suite_permissions"
down_revision: str | None = "0004_staff_grants_not_demoting"
branch_labels: str | Sequence[str] | None = None
depends_on: str | Sequence[str] | None = None

_NEW = ["scout.projects.delete", "scout.project.members"]


def upgrade() -> None:
    for perm in _NEW:
        op.execute(
            f"""
            UPDATE app_levels
               SET permissions = permissions::jsonb || '["{perm}"]'::jsonb
             WHERE name = 'admin'
               AND NOT permissions::jsonb ? '{perm}'
            """
        )


def downgrade() -> None:
    for perm in _NEW:
        op.execute(
            f"""
            UPDATE app_levels
               SET permissions = (permissions::jsonb - '{perm}')
             WHERE name = 'admin'
            """
        )