document-management/backend/migrations/versions/0033_role_upload_permission.py

"""方案权限矩阵新增「上传」权限（契约1.31）：sys_role_permission 加 can_upload 列。

Revision ID: 0033_role_upload_permission
Revises: 0032_user_managed_org
Create Date: 2026-09-13

变更要点：
1. sys_role_permission 新增 can_upload 布尔列（默认 0）：
   - 仅 OWN 行有意义，控制管理员「上传主体方案/批量导入方案」入口
     与 POST /documents 链路；OTHER 行恒 0（服务端校验拒绝置真）；
2. canBindAttachment/canUnbindAttachment 界面合并为单一「挂载」开关、
   两列恒同值，库列保留不变（兼容存量数据渐进收敛）；
3. 升级幂等：加列先探测后执行（与 Flyway V18 并行互不冲突）；
4. 降级直接删列（布尔权限列无存量语义，无有损风险）。
"""

from __future__ import annotations

from collections.abc import Sequence

import sqlalchemy as sa
from alembic import op

revision: str = "0033_role_upload_permission"
down_revision: str | None = "0032_user_managed_org"
branch_labels: str | Sequence[str] | None = None
depends_on: str | Sequence[str] | None = None


def _existing_columns() -> set[str]:
    inspector = sa.inspect(op.get_bind())
    return {
        column["name"].lower()
        for column in inspector.get_columns("sys_role_permission")
    }


def upgrade() -> None:
    # sys_role_permission.can_upload 加列（先探测后执行，幂等）
    if "can_upload" not in _existing_columns():
        op.add_column(
            "sys_role_permission",
            sa.Column(
                "can_upload",
                sa.Boolean(),
                nullable=False,
                server_default=sa.text("0"),
            ),
        )


def downgrade() -> None:
    if "can_upload" in _existing_columns():
        op.drop_column("sys_role_permission", "can_upload")