"""Fence downgrades before they can re-expose revoked tenant gateways.

Alembic downgrades one revision at a time.  This marker's downgrade is the
first step from every secured WP10 head, so live tenant data is rejected
before 509..504 can be unwound and before 503's payload-authorized functions
could ever be restored.
"""

from alembic import op

revision = "20260817_510"
down_revision = "20260817_509"
branch_labels = None
depends_on = None


def upgrade() -> None:
    # Marker-only upgrade; the fail-closed behavior belongs to the first
    # downgrade edge, not to a mutable historical revision.
    return None


def downgrade() -> None:
    op.execute(
        """
        DO $$ BEGIN
          IF EXISTS (SELECT 1 FROM public.tenants LIMIT 1)
             OR EXISTS (SELECT 1 FROM public.tenant_quotas LIMIT 1)
             OR EXISTS (SELECT 1 FROM public.tenant_quota_reservations LIMIT 1)
             OR EXISTS (SELECT 1 FROM public.tenant_lifecycle_events LIMIT 1)
             OR EXISTS (SELECT 1 FROM public.tenant_audit_events LIMIT 1)
             OR EXISTS (SELECT 1 FROM public.tenant_resource_manifests LIMIT 1)
             OR EXISTS (SELECT 1 FROM public.tenant_control_memberships LIMIT 1)
             OR EXISTS (SELECT 1 FROM public.tenant_control_claims LIMIT 1)
             OR EXISTS (SELECT 1 FROM public.tenant_legal_holds LIMIT 1) THEN
            RAISE EXCEPTION 'tenant security downgrade refused while tenant data exists';
          END IF;
        END $$;
        """
    )