"""add api_key_encrypted column to api_keys

Revision ID: c3d4e5f6g7h8
Revises: b2c3d4e5f6g7h
Create Date: 2026-07-28 16:00:00.000000

添加 api_key_encrypted 字段用于存储加密的完整 API Key，支持随时揭秘复制。
"""
from typing import Sequence, Union

from alembic import op
import sqlalchemy as sa


# revision identifiers, used by Alembic.
revision: str = 'c3d4e5f6g7h8'
down_revision: Union[str, None] = 'b2c3d4e5f6g7h'
branch_labels: Union[str, Sequence[str], None] = None
depends_on: Union[str, Sequence[str], None] = None


def upgrade() -> None:
    op.add_column(
        'api_keys',
        sa.Column('api_key_encrypted', sa.Text, nullable=True, comment='AES-256-GCM 加密的完整 API Key'),
    )
    # 为现有记录设置空值（新创建的 Key 会自动加密）
    op.execute("UPDATE api_keys SET api_key_encrypted = '' WHERE api_key_encrypted IS NULL")
    op.alter_column('api_keys', 'api_key_encrypted', nullable=False)


def downgrade() -> None:
    op.drop_column('api_keys', 'api_key_encrypted')