# Generated by Django 6.0 on 2026-04-07 10:55

import api.models
import django.db.models.deletion
import uuid
from django.conf import settings
from django.db import migrations, models


class Migration(migrations.Migration):

    dependencies = [
        ("api", "0334_add_cta_unlock_agent_copy_flag"),
        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
    ]

    operations = [
        migrations.CreateModel(
            name="GlobalSecret",
            fields=[
                (
                    "id",
                    models.UUIDField(
                        default=uuid.uuid4,
                        editable=False,
                        primary_key=True,
                        serialize=False,
                    ),
                ),
                (
                    "domain_pattern",
                    models.CharField(
                        help_text="Domain pattern where this secret can be used (e.g., 'https://example.com', '*.google.com')",
                        max_length=256,
                    ),
                ),
                (
                    "name",
                    models.CharField(
                        help_text="Human-readable name for this secret", max_length=128
                    ),
                ),
                (
                    "description",
                    models.TextField(
                        blank=True,
                        help_text="Optional description of what this secret is used for",
                    ),
                ),
                (
                    "key",
                    models.CharField(
                        blank=True,
                        help_text="Secret key name (auto-generated from name)",
                        max_length=64,
                    ),
                ),
                (
                    "secret_type",
                    models.CharField(
                        choices=[
                            ("credential", "Credential"),
                            ("env_var", "Environment Variable"),
                        ],
                        default="credential",
                        max_length=16,
                    ),
                ),
                (
                    "encrypted_value",
                    models.BinaryField(help_text="AES-256-GCM encrypted secret value"),
                ),
                ("created_at", models.DateTimeField(auto_now_add=True)),
                ("updated_at", models.DateTimeField(auto_now=True)),
                (
                    "organization",
                    models.ForeignKey(
                        blank=True,
                        null=True,
                        on_delete=django.db.models.deletion.CASCADE,
                        related_name="global_secrets",
                        to="api.organization",
                    ),
                ),
                (
                    "user",
                    models.ForeignKey(
                        blank=True,
                        null=True,
                        on_delete=django.db.models.deletion.CASCADE,
                        related_name="global_secrets",
                        to=settings.AUTH_USER_MODEL,
                    ),
                ),
            ],
            options={
                "ordering": ["domain_pattern", "name"],
                "indexes": [
                    models.Index(
                        fields=["user", "secret_type"], name="gs_user_type_idx"
                    ),
                    models.Index(
                        fields=["organization", "secret_type"], name="gs_org_type_idx"
                    ),
                ],
                "constraints": [
                    models.CheckConstraint(
                        condition=models.Q(
                            models.Q(
                                ("organization__isnull", True), ("user__isnull", False)
                            ),
                            models.Q(
                                ("organization__isnull", False), ("user__isnull", True)
                            ),
                            _connector="OR",
                        ),
                        name="global_secret_exactly_one_owner",
                    ),
                    models.UniqueConstraint(
                        condition=models.Q(("user__isnull", False)),
                        fields=("user", "secret_type", "domain_pattern", "name"),
                        name="unique_global_secret_user_name",
                    ),
                    models.UniqueConstraint(
                        condition=models.Q(("user__isnull", False)),
                        fields=("user", "secret_type", "domain_pattern", "key"),
                        name="unique_global_secret_user_key",
                    ),
                    models.UniqueConstraint(
                        condition=models.Q(("organization__isnull", False)),
                        fields=(
                            "organization",
                            "secret_type",
                            "domain_pattern",
                            "name",
                        ),
                        name="unique_global_secret_org_name",
                    ),
                    models.UniqueConstraint(
                        condition=models.Q(("organization__isnull", False)),
                        fields=("organization", "secret_type", "domain_pattern", "key"),
                        name="unique_global_secret_org_key",
                    ),
                ],
            },
            bases=(api.models.SecretModelMixin, models.Model),
        ),
    ]
