"""grant dashboard:read to technician roles (new dashboard tab)

Revision ID: 20260928_dash
Revises: 20260928_scope
Create Date: 2026-09-28 00:00:00.000000

Safe: the technician dashboard tab is new, so no existing customization
could have set these rows deliberately. The global permission off-switch
(Permission.is_active) still overrides everything.
"""

from collections.abc import Sequence

from alembic import op
from sqlalchemy import text

revision: str = "20260928_dash"
down_revision: str | None = "20260928_scope"
branch_labels: str | Sequence[str] | None = None
depends_on: str | Sequence[str] | None = None


def upgrade() -> None:
    conn = op.get_bind()
    conn.execute(
        text(
            """
            UPDATE role_permission SET default_granted = TRUE
            WHERE role IN ('phlebotomist', 'general_user')
              AND permission_id = (SELECT id FROM permission WHERE code = 'dashboard:read')
            """
        )
    )


def downgrade() -> None:
    conn = op.get_bind()
    conn.execute(
        text(
            """
            UPDATE role_permission SET default_granted = FALSE
            WHERE role IN ('phlebotomist', 'general_user')
              AND permission_id = (SELECT id FROM permission WHERE code = 'dashboard:read')
            """
        )
    )