DataOps-platform/migrations/versions/20260817_515_tenant_final_downgrade_fence.py

"""Make the current secured head fail closed before any downgrade step."""

from alembic import op

revision = "20260817_515"
down_revision = "20260817_514"
branch_labels = None
depends_on = None


def upgrade() -> None:
    # The guard lives on the downgrade edge so it covers every final head
    # without changing the already-applied 501--514 history.
    return None


def downgrade() -> None:
    op.execute("""
      DO $$ BEGIN
        IF EXISTS (SELECT 1 FROM public.tenants LIMIT 1)
          OR EXISTS (SELECT 1 FROM public.tenant_quotas LIMIT 1)
          OR EXISTS (SELECT 1 FROM public.tenant_quota_reservations LIMIT 1)
          OR EXISTS (SELECT 1 FROM public.tenant_lifecycle_events LIMIT 1)
          OR EXISTS (SELECT 1 FROM public.tenant_audit_events LIMIT 1)
          OR EXISTS (SELECT 1 FROM public.tenant_resource_manifests LIMIT 1)
          OR EXISTS (SELECT 1 FROM public.tenant_control_memberships LIMIT 1)
          OR EXISTS (SELECT 1 FROM public.tenant_control_claims LIMIT 1)
          OR EXISTS (SELECT 1 FROM public.tenant_legal_holds LIMIT 1)
          OR EXISTS (SELECT 1 FROM public.tenant_control_outbox LIMIT 1)
          OR EXISTS (SELECT 1 FROM public.tenant_control_outbox_scope_lookup LIMIT 1) THEN
          RAISE EXCEPTION 'tenant security downgrade refused while tenant data exists';
        END IF;
      END $$;
    """)