neiam /gitgud

defmodule GitGud.Repo.Migrations.ScopeRunners do
  use Ecto.Migration

  def change do
    # Per-scope runner registration tokens. SHA-256 hash of the bare
    # token; the bare token is shown to the operator once on mint and
    # not recoverable later. Regenerating produces a new token + hash.
    alter table(:repositories) do
      add :runner_reg_token_hash, :binary
    end

    alter table(:organizations) do
      add :runner_reg_token_hash, :binary
    end

    create unique_index(:repositories, [:runner_reg_token_hash],
             where: "runner_reg_token_hash IS NOT NULL",
             name: :repositories_runner_reg_token_hash_index
           )

    create unique_index(:organizations, [:runner_reg_token_hash],
             where: "runner_reg_token_hash IS NOT NULL",
             name: :organizations_runner_reg_token_hash_index
           )

    # Runner scope. NULL on both = global (the legacy env-token path).
    # At most one may be set; enforced via a CHECK constraint so the DB
    # can't accidentally accumulate inconsistent rows.
    alter table(:runners) do
      add :repository_id, references(:repositories, on_delete: :delete_all)
      add :organization_id, references(:organizations, on_delete: :delete_all)
    end

    create constraint(:runners, :runners_scope_xor,
             check: "(repository_id IS NULL) OR (organization_id IS NULL)"
           )

    create index(:runners, [:repository_id])
    create index(:runners, [:organization_id])
  end
end