-- Temporary external access grants (Redis, RabbitMQ, database)
DO $$ BEGIN
  CREATE TYPE service_access_target AS ENUM (
    'database',
    'redis',
    'rabbitmq_amqp',
    'rabbitmq_management'
  );
EXCEPTION WHEN duplicate_object THEN null; END $$;

DO $$ BEGIN
  CREATE TYPE service_access_grant_status AS ENUM (
    'active',
    'expired',
    'revoked'
  );
EXCEPTION WHEN duplicate_object THEN null; END $$;

CREATE TABLE IF NOT EXISTS service_access_grants (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  "applicationId" UUID NOT NULL REFERENCES applications(id) ON DELETE CASCADE,
  "userId" UUID NOT NULL,
  "clusterId" UUID NOT NULL,
  namespace VARCHAR(255) NOT NULL,
  target service_access_target NOT NULL,
  "nodePort" INTEGER NOT NULL,
  "targetPort" INTEGER NOT NULL,
  host VARCHAR(255) NOT NULL,
  "k8sServiceName" VARCHAR(255) NOT NULL,
  status service_access_grant_status NOT NULL DEFAULT 'active',
  "expiresAt" TIMESTAMPTZ NOT NULL,
  "createdAt" TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

CREATE INDEX IF NOT EXISTS idx_service_access_grants_app_target_status
  ON service_access_grants ("applicationId", target, status);

INSERT INTO platform_settings (id, key, value, description, "createdAt", "updatedAt")
SELECT gen_random_uuid(), 'access_max_duration_minutes', '240',
  'Maximum duration (minutes) for temporary external service access',
  NOW(), NOW()
WHERE NOT EXISTS (
  SELECT 1 FROM platform_settings WHERE key = 'access_max_duration_minutes'
);