# Generated by Django 4.2.28 on 2026-06-05 17:22

import django.contrib.auth.validators
import django.db.models.deletion
import pgtrigger.compiler
import pgtrigger.migrations
from django.conf import settings
from django.db import migrations, models


class Migration(migrations.Migration):
    dependencies = [
        ('db', '0060_collectionrole'),
    ]

    operations = [
        pgtrigger.migrations.RemoveTrigger(
            model_name='token',
            name='db_token_required_type_parameters',
        ),
        migrations.RemoveConstraint(
            model_name='token',
            name='db_token_consistent_type',
        ),
        migrations.RemoveConstraint(
            model_name='token',
            name='db_token_valid_type',
        ),
        migrations.AddField(
            model_name='token',
            name='created_by',
            field=models.ForeignKey(
                blank=True,
                null=True,
                on_delete=django.db.models.deletion.PROTECT,
                related_name='created_tokens',
                to=settings.AUTH_USER_MODEL,
            ),
        ),
        migrations.AddField(
            model_name='token',
            name='explicit_grants_only',
            field=models.BooleanField(default=False),
        ),
        migrations.AddField(
            model_name='token',
            name='external_username',
            field=models.CharField(
                blank=True,
                help_text='Username to be used with an external user token; letters, digits, and @/./+/-/_ only.',
                max_length=150,
                validators=[
                    django.contrib.auth.validators.UnicodeUsernameValidator()
                ],
            ),
        ),
        migrations.AlterField(
            model_name='token',
            name='token_type',
            field=models.CharField(
                choices=[
                    ('worker-activation', 'Worker activation'),
                    ('worker', 'Worker'),
                    ('work-request', 'Work request'),
                    ('user', 'User'),
                    ('external-user', 'User without a Debusine identity'),
                ]
            ),
        ),
        pgtrigger.migrations.AddTrigger(
            model_name='token',
            trigger=pgtrigger.compiler.Trigger(
                name='db_token_required_type_parameters',
                sql=pgtrigger.compiler.UpsertTriggerSql(
                    constraint='CONSTRAINT',
                    func="SELECT * FROM db_token INTO NEW WHERE id = db_token.id; IF NEW.token_type = 'worker-activation' AND NEW.activating_worker_id IS NULL THEN RAISE EXCEPTION 'Worker activation token % has no activating worker', NEW.id; ELSIF NEW.token_type = 'worker' AND NEW.worker_id IS NULL THEN RAISE EXCEPTION 'Worker token % has no worker', NEW.id; ELSIF NEW.token_type = 'work-request' AND NEW.work_request_id IS NULL THEN RAISE EXCEPTION 'Work request token % has no work request', NEW.id; ELSIF NEW.token_type = 'user' AND NEW.user_id IS NULL THEN RAISE EXCEPTION 'User token % has no user', NEW.id; ELSIF NEW.token_type = 'external-user' AND new.external_username = '' THEN RAISE EXCEPTION 'External user token % has no username', NEW.id; ELSE RETURN NULL; END IF;",
                    hash='81b29584f27cdfa182329f17fa29b82cf1cb615a',
                    operation='INSERT OR UPDATE',
                    pgid='pgtrigger_db_token_required_type_parameters_a5603',
                    table='db_token',
                    timing='DEFERRABLE INITIALLY DEFERRED',
                    when='AFTER',
                ),
            ),
        ),
        migrations.AddConstraint(
            model_name='token',
            constraint=models.CheckConstraint(
                condition=models.Q(
                    (
                        'token_type__in',
                        [
                            'external-user',
                            'user',
                            'work-request',
                            'worker',
                            'worker-activation',
                        ],
                    )
                ),
                name='db_token_valid_type',
            ),
        ),
        migrations.AddConstraint(
            model_name='token',
            constraint=models.CheckConstraint(
                condition=models.Q(
                    models.Q(
                        ('token_type', 'worker-activation'),
                        ('_activating_worker_id__isnull', True),
                        _connector='OR',
                    ),
                    models.Q(
                        ('token_type', 'worker'),
                        ('_worker_id__isnull', True),
                        _connector='OR',
                    ),
                    models.Q(
                        ('token_type', 'work-request'),
                        ('work_request_id__isnull', True),
                        _connector='OR',
                    ),
                    models.Q(
                        ('token_type', 'user'),
                        ('user__isnull', True),
                        _connector='OR',
                    ),
                    models.Q(
                        ('token_type', 'external-user'),
                        ('external_username', ''),
                        _connector='OR',
                    ),
                ),
                name='db_token_consistent_type',
            ),
        ),
        migrations.AddConstraint(
            model_name='token',
            constraint=models.CheckConstraint(
                condition=models.Q(
                    models.Q(
                        models.Q(
                            ('token_type', 'external-user'), _negated=True
                        ),
                        ('explicit_grants_only', True),
                        _connector='OR',
                    ),
                    models.Q(
                        ('token_type__in', ('user', 'external-user')),
                        ('explicit_grants_only', False),
                        _connector='OR',
                    ),
                ),
                name='db_token_consistent_grants',
            ),
        ),
    ]
