"""Server-wide secrets set from the Admin page (the Anthropic API key).

Values are encrypted with APP_SECRET_KEY (server env file) before storage, so
database backups hold ciphertext only.

Revision ID: 0004
Revises: 0003
Create Date: 2026-09-18
"""

from alembic import op

revision = "0004"
down_revision = "0003"
branch_labels = None
depends_on = None

UPGRADE = """
CREATE TABLE app_secrets (
    name text PRIMARY KEY,
    ciphertext text NOT NULL,
    last4 text NOT NULL,
    updated_by integer REFERENCES users(id) ON DELETE SET NULL,
    updated_at timestamptz NOT NULL DEFAULT now()
);
"""


def upgrade() -> None:
    op.execute(UPGRADE)


def downgrade() -> None:
    op.execute("DROP TABLE app_secrets")