"""phase41 — add 'auditor' role to users.role ENUM

Introduces a new staff role, Auditor, with the same access as Project Manager
plus full issue-management powers (create, assign, quick-assign, handler/vendor
triage, request-verification, verify/bulk-verify/verification-queue) — but NOT
issue deletion (that stays admin/director via @supervisor_required).

Ported from the single-tenant chain (phase40_auditor_role) and renumbered onto
the multi-tenant HEAD.

This is a pure ENUM expansion (adds a value, removes none, no data migration),
so the 3-step ENUM protocol does not apply. Re-running the same MODIFY is a
no-op — safe to re-run on every tenant DB.
"""

revision      = 'phase41_auditor_role'
down_revision = 'phase40_support_chat_kb'
branch_labels = None
depends_on    = None

from alembic import op
import sqlalchemy as sa


_ENUM_WITH_AUDITOR = (
    "ENUM('admin','director','inspector','project_manager','customer','auditor')"
)
_ENUM_WITHOUT_AUDITOR = (
    "ENUM('admin','director','inspector','project_manager','customer')"
)


def upgrade():
    # Idempotent: MODIFY to the expanded set is harmless if already applied.
    op.execute(sa.text(
        f"ALTER TABLE users MODIFY COLUMN role {_ENUM_WITH_AUDITOR} NOT NULL"
    ))


def downgrade():
    # Reassign any auditor rows before contracting the ENUM so no data is lost.
    op.execute(sa.text(
        "UPDATE users SET role = 'project_manager' WHERE role = 'auditor'"
    ))
    op.execute(sa.text(
        f"ALTER TABLE users MODIFY COLUMN role {_ENUM_WITHOUT_AUDITOR} NOT NULL"
    ))