"""Harden enterprise identity secret references."""

from alembic import op

revision = "20260802_471"
down_revision = "20260802_470"
branch_labels = None
depends_on = None


def upgrade() -> None:
    op.execute(
        """
        ALTER TABLE public.identity_idp_config_versions
          DROP CONSTRAINT IF EXISTS identity_idp_config_versions_secret_ref_check;
        ALTER TABLE public.identity_idp_config_versions
          ADD CONSTRAINT ck_identity_idp_secret_ref_dataops_oidc
          CHECK (secret_ref ~ '^env:DATAOPS_OIDC_[A-Z0-9_]+$');
        """
    )


def downgrade() -> None:
    raise RuntimeError("Forward-only migration: identity secret boundary cannot be weakened")