<?php

declare(strict_types=1);

namespace DoctrineMigrations;

use Doctrine\DBAL\Schema\Schema;
use Doctrine\Migrations\AbstractMigration;

/**
 * Adds the per-client role requirement that App\EventListener\AuthorizationCodeListener
 * gates the authorization code grant on.
 *
 * The column defaults to an empty list and an empty list denies, so every client is
 * refused until its roles are set. The two clients in actual use are therefore set here
 * rather than by hand after the deploy: it closes the window in which both staff tools
 * would be live but unable to authorize anyone, and it keeps the role strings somewhere
 * review can see them.
 *
 * Matched on name, not identifier: client identifiers are generated per environment and
 * differ between local, staging and production, while the names do not.
 *
 * Deliberately left empty, and so denied: myepapp (the mobile app) and myep (the Keycloak
 * broker), both R&D only and not in use. The client_credentials clients never reach the
 * authorization endpoint and are unaffected either way.
 */
final class Version20260923120000 extends AbstractMigration
{
    public function getDescription(): string
    {
        return 'Adds oauth2_client.required_roles and sets it for the two staff clients.';
    }

    public function up(Schema $schema): void
    {
        // Added nullable and backfilled before being tightened: a NOT NULL column with no
        // default leaves existing rows holding an empty string, which is not valid JSON and
        // fails to hydrate -- the row cannot even reach the listener that would deny it.
        $this->addSql("ALTER TABLE oauth2_client ADD required_roles JSON DEFAULT NULL COMMENT '(DC2Type:json)'");
        $this->addSql("UPDATE oauth2_client SET required_roles = '[]'");
        $this->addSql("ALTER TABLE oauth2_client MODIFY required_roles JSON NOT NULL COMMENT '(DC2Type:json)'");

        // mirrors ephub's App\Security\Role::ELIGIBLE
        $this->addSql('UPDATE oauth2_client SET required_roles = :roles WHERE name = :name', [
            'roles' => json_encode(['ROLE_EMPLOYEE', 'ROLE_ADMIN'], JSON_THROW_ON_ERROR),
            'name' => 'EPHub',
        ]);

        // mirrors myep-team's App\Security\MyEpAuthenticator::ELIGIBLE_ROLES
        $this->addSql('UPDATE oauth2_client SET required_roles = :roles WHERE name = :name', [
            'roles' => json_encode(['ROLE_TEAM_ADMIN', 'ROLE_TEAMER', 'ROLE_MANAGER', 'ROLE_HOUSE_MANAGER'], JSON_THROW_ON_ERROR),
            'name' => 'MyEPTeam',
        ]);
    }

    public function down(Schema $schema): void
    {
        $this->addSql('ALTER TABLE oauth2_client DROP required_roles');
    }
}