<?php
declare(strict_types=1);

use Phinx\Migration\AbstractMigration;

final class CreateRolesAndUsers extends AbstractMigration
{
    public function change(): void
    {
        // Roles are GLOBAL (not per-tenant) — same role definitions apply everywhere.
        $this->table('roles', ['id' => 'role_id', 'signed' => false])
            ->addColumn('code',        'string', ['limit' => 40])
            ->addColumn('name',        'string', ['limit' => 100])
            ->addColumn('description', 'string', ['limit' => 255, 'null' => true])
            ->addColumn('created_at',  'datetime',['default' => 'CURRENT_TIMESTAMP'])
            ->addIndex(['code'], ['unique' => true])
            ->create();

        $this->table('roles')->insert([
            ['code' => 'admin',             'name' => 'Administrator',       'description' => 'Full access, all tenants'],
            ['code' => 'executive',         'name' => 'Executive',           'description' => 'Portfolio-level read + reports'],
            ['code' => 'project_manager',   'name' => 'Project Manager',     'description' => 'Manage projects, WOs, incidents, approvals'],
            ['code' => 'field_technician',  'name' => 'Field Technician',    'description' => 'Execute WOs, log incidents, mobile-first'],
            ['code' => 'client',            'name' => 'Client',              'description' => 'Read-only client-portal access to own tenant'],
        ])->saveData();

        // Users are SCOPED to a tenant. tenant_id is NOT NULL — every user belongs to exactly one tenant.
        // Admins that need cross-tenant access get a separate user row per tenant, or role=admin + null tenant_id
        // (handled in a later migration when we add impersonation).
        $this->table('users', ['id' => 'user_id', 'signed' => false])
            ->addColumn('tenant_id', 'integer', ['signed' => false])
            ->addColumn('role_id',   'integer', ['null' => true, 'signed' => false])
            ->addColumn('username',  'string',  ['limit' => 64])
            ->addColumn('password',  'string',  ['limit' => 255])
            ->addColumn('f_name',    'string',  ['limit' => 64, 'null' => true])
            ->addColumn('l_name',    'string',  ['limit' => 64, 'null' => true])
            ->addColumn('email',     'string',  ['limit' => 120, 'null' => true])
            ->addColumn('phone',     'string',  ['limit' => 30, 'null' => true])
            ->addColumn('job_title', 'string',  ['limit' => 100, 'null' => true])
            ->addColumn('avatar_path','string', ['limit' => 255, 'null' => true])
            ->addColumn('status',    'string',  ['limit' => 20, 'default' => 'active'])
            ->addColumn('last_login_at','datetime',['null' => true])
            ->addColumn('created_at', 'datetime',['default' => 'CURRENT_TIMESTAMP'])
            ->addColumn('updated_at', 'datetime',['default' => 'CURRENT_TIMESTAMP', 'update' => 'CURRENT_TIMESTAMP'])
            ->addColumn('deleted_at', 'datetime',['null' => true])
            // Username is unique WITHIN a tenant. Two tenants can each have a user "admin".
            ->addIndex(['tenant_id', 'username'], ['unique' => true])
            ->addIndex(['tenant_id', 'status'])
            ->addIndex(['role_id'])
            ->addForeignKey('tenant_id', 'tenants', 'tenant_id', ['delete' => 'RESTRICT', 'update' => 'CASCADE'])
            ->addForeignKey('role_id',   'roles',   'role_id',   ['delete' => 'SET_NULL', 'update' => 'CASCADE'])
            ->create();
    }
}
