DataOps-platform/migrations/versions/20260817_525_final_tenant_downgrade_fence.py

"""Refuse the first downgrade step while any tenant security fact remains."""

from alembic import op

revision = "20260817_525"
down_revision = "20260817_524"
branch_labels = None
depends_on = None


def upgrade() -> None:
    # Marker-only head: its downgrade is intentionally the outermost safety
    # fence, so Alembic cannot reach 521's compatibility grant with live data.
    pass


def downgrade() -> None:
    op.execute(
        "DO $$ BEGIN "
        "IF EXISTS(SELECT 1 FROM public.tenants LIMIT 1) "
        "OR EXISTS(SELECT 1 FROM public.tenant_control_memberships LIMIT 1) "
        "OR EXISTS(SELECT 1 FROM public.tenant_control_claims LIMIT 1) "
        "OR EXISTS(SELECT 1 FROM public.tenant_control_outbox LIMIT 1) "
        "OR EXISTS(SELECT 1 FROM public.tenant_control_outbox_scope_lookup LIMIT 1) "
        "OR EXISTS(SELECT 1 FROM public.tenant_provision_operations LIMIT 1) "
        "OR EXISTS(SELECT 1 FROM public.tenant_approval_facts LIMIT 1) "
        "OR EXISTS(SELECT 1 FROM public.tenant_quotas LIMIT 1) "
        "OR EXISTS(SELECT 1 FROM public.tenant_quota_reservations LIMIT 1) "
        "OR EXISTS(SELECT 1 FROM public.tenant_lifecycle_events LIMIT 1) "
        "OR EXISTS(SELECT 1 FROM public.tenant_audit_events LIMIT 1) "
        "OR EXISTS(SELECT 1 FROM public.tenant_legal_holds LIMIT 1) "
        "THEN RAISE EXCEPTION 'tenant final downgrade refused while tenant control data exists'; END IF; "
        "END $$;"
    )