-- CL3: Plesk connection + sync MVP hardening

-- 1) plesk_instances credential/storage hardening
alter table public.plesk_instances
  add column if not exists encrypted_secret text,
  add column if not exists secret_kid text,
  add column if not exists error_message text;

do $$
begin
  if exists (
    select 1
    from information_schema.columns
    where table_schema = 'public'
      and table_name = 'plesk_instances'
      and column_name = 'auth_secret_encrypted'
  ) then
    update public.plesk_instances
    set encrypted_secret = coalesce(encrypted_secret, auth_secret_encrypted)
    where encrypted_secret is null;

    alter table public.plesk_instances
      drop column auth_secret_encrypted;
  end if;
end $$;

update public.plesk_instances
set status = 'connected'
where status = 'active';

alter table public.plesk_instances
  alter column encrypted_secret set not null,
  alter column status set default 'error';

alter table public.plesk_instances
  drop constraint if exists plesk_instances_auth_type_check;

alter table public.plesk_instances
  add constraint plesk_instances_auth_type_check
  check (auth_type in ('api_key', 'basic'));

alter table public.plesk_instances
  drop constraint if exists plesk_instances_status_check;

alter table public.plesk_instances
  add constraint plesk_instances_status_check
  check (status in ('connected', 'error', 'disabled'));

-- 2) FK guarantees
do $$
begin
  if not exists (
    select 1 from pg_constraint
    where conname = 'plesk_instances_agency_id_fkey'
  ) then
    alter table public.plesk_instances
      add constraint plesk_instances_agency_id_fkey
      foreign key (agency_id) references public.agencies(id) on delete cascade;
  end if;

  if not exists (
    select 1 from pg_constraint
    where conname = 'plesk_subscriptions_plesk_instance_id_fkey'
  ) then
    alter table public.plesk_subscriptions
      add constraint plesk_subscriptions_plesk_instance_id_fkey
      foreign key (plesk_instance_id) references public.plesk_instances(id) on delete cascade;
  end if;

  if not exists (
    select 1 from pg_constraint
    where conname = 'plesk_domains_subscription_id_fkey'
  ) then
    alter table public.plesk_domains
      add constraint plesk_domains_subscription_id_fkey
      foreign key (subscription_id) references public.plesk_subscriptions(id) on delete cascade;
  end if;
end $$;

-- 3) Uniques + indexes
create unique index if not exists uq_plesk_instances_agency_base_url
  on public.plesk_instances (agency_id, base_url);

create unique index if not exists uq_plesk_subscriptions_agency_external
  on public.plesk_subscriptions (agency_id, plesk_subscription_id);

create unique index if not exists uq_plesk_domains_agency_external
  on public.plesk_domains (agency_id, plesk_domain_id);

create index if not exists idx_plesk_instances_agency_id
  on public.plesk_instances (agency_id);

create index if not exists idx_plesk_subscriptions_agency_id
  on public.plesk_subscriptions (agency_id);

create index if not exists idx_plesk_subscriptions_instance_id
  on public.plesk_subscriptions (plesk_instance_id);

create index if not exists idx_plesk_domains_agency_id
  on public.plesk_domains (agency_id);

create index if not exists idx_plesk_domains_instance_id
  on public.plesk_domains (plesk_instance_id);

create index if not exists idx_plesk_domains_subscription_id
  on public.plesk_domains (subscription_id);