<?php

declare(strict_types=1);

namespace Plugin\tnt_mcp\Migrations;

use JTL\Plugin\Migration;
use JTL\Update\IMigration;

/**
 * OAuth 2.1 persistence for the MCP server (league/oauth2-server backing store). Adds the four
 * entity tables the authorization-code + PKCE + refresh-token flow needs:
 *  - tnt_mcp_oauth_client        : dynamically-registered connectors (public/PKCE by default).
 *  - tnt_mcp_oauth_auth_code     : single-use, short-lived authorization codes.
 *  - tnt_mcp_oauth_access_token  : issued access-token ids (for revocation / deny-by-default).
 *  - tnt_mcp_oauth_refresh_token : refresh-token ids.
 * The legacy tnt_mcp_token / tnt_mcp_audit tables (previous migration) are untouched — the static
 * token path keeps working alongside OAuth.
 */
class Migration20260724000000 extends Migration implements IMigration
{
    public function up(): void
    {
        $this->execute("CREATE TABLE IF NOT EXISTS `tnt_mcp_oauth_client` (
                `kClient` INT(10) UNSIGNED NOT NULL AUTO_INCREMENT,
                `cClientId` VARCHAR(191) NOT NULL,
                `cName` VARCHAR(191) NOT NULL DEFAULT '',
                `cRedirectUris` TEXT NOT NULL,
                `nConfidential` TINYINT(1) NOT NULL DEFAULT 0,
                `cSecretHash` CHAR(64) NULL DEFAULT NULL,
                `cScopes` TEXT NOT NULL,
                `cGrantTypes` TEXT NOT NULL,
                `dCreated` DATETIME NOT NULL,
                PRIMARY KEY (`kClient`),
                UNIQUE KEY `idx_tnt_mcp_oauth_client_id` (`cClientId`)
            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci");

        $this->execute("CREATE TABLE IF NOT EXISTS `tnt_mcp_oauth_auth_code` (
                `cCode` VARCHAR(191) NOT NULL,
                `cClientId` VARCHAR(191) NOT NULL,
                `cUserId` VARCHAR(191) NOT NULL DEFAULT '',
                `cScopes` TEXT NOT NULL,
                `dExpires` DATETIME NOT NULL,
                `nRevoked` TINYINT(1) NOT NULL DEFAULT 0,
                `dCreated` DATETIME NOT NULL,
                PRIMARY KEY (`cCode`),
                KEY `idx_tnt_mcp_oauth_auth_code_exp` (`dExpires`)
            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci");

        $this->execute("CREATE TABLE IF NOT EXISTS `tnt_mcp_oauth_access_token` (
                `cToken` VARCHAR(191) NOT NULL,
                `cClientId` VARCHAR(191) NOT NULL,
                `cUserId` VARCHAR(191) NOT NULL DEFAULT '',
                `cScopes` TEXT NOT NULL,
                `dExpires` DATETIME NOT NULL,
                `nRevoked` TINYINT(1) NOT NULL DEFAULT 0,
                `dCreated` DATETIME NOT NULL,
                PRIMARY KEY (`cToken`),
                KEY `idx_tnt_mcp_oauth_access_token_exp` (`dExpires`)
            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci");

        $this->execute("CREATE TABLE IF NOT EXISTS `tnt_mcp_oauth_refresh_token` (
                `cToken` VARCHAR(191) NOT NULL,
                `cAccessTokenId` VARCHAR(191) NOT NULL DEFAULT '',
                `dExpires` DATETIME NOT NULL,
                `nRevoked` TINYINT(1) NOT NULL DEFAULT 0,
                `dCreated` DATETIME NOT NULL,
                PRIMARY KEY (`cToken`),
                KEY `idx_tnt_mcp_oauth_refresh_token_exp` (`dExpires`)
            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci");
    }

    public function down(): void
    {
        $this->execute('DROP TABLE IF EXISTS `tnt_mcp_oauth_refresh_token`');
        $this->execute('DROP TABLE IF EXISTS `tnt_mcp_oauth_access_token`');
        $this->execute('DROP TABLE IF EXISTS `tnt_mcp_oauth_auth_code`');
        $this->execute('DROP TABLE IF EXISTS `tnt_mcp_oauth_client`');
    }
}
