"""Ensure approval-required lifecycle transitions cannot bypass their wrapper."""

from alembic import op


revision = "20260817_521"
down_revision = "20260817_520"
branch_labels = None
depends_on = None


def upgrade() -> None:
    op.execute(
        "REVOKE ALL ON FUNCTION public.tenant_control_lifecycle_mutate(uuid,uuid,jsonb) "
        "FROM PUBLIC,dataops_app_runtime,dataops_tenant_control,dataops_tenant_approver"
    )


def downgrade() -> None:
    op.execute(
        "GRANT EXECUTE ON FUNCTION public.tenant_control_lifecycle_mutate(uuid,uuid,jsonb) "
        "TO dataops_tenant_control"
    )