"""trim system roles to kept list (remove admin, manager)

Revision ID: 20260928_roles
Revises: 20260928_units
Create Date: 2026-09-28 00:00:00.000000

"""

from collections.abc import Sequence

from alembic import op
from sqlalchemy import text

revision: str = "20260928_roles"
down_revision: str | None = "20260928_units"
branch_labels: str | Sequence[str] | None = None
depends_on: str | Sequence[str] | None = None

REMOVED_ROLES = ("admin", "manager")


def upgrade() -> None:
    conn = op.get_bind()
    for code in REMOVED_ROLES:
        conn.execute(text("DELETE FROM role_permission WHERE role = :code").bindparams(code=code))
        conn.execute(text("DELETE FROM role WHERE code = :code AND is_system IS TRUE").bindparams(code=code))


def downgrade() -> None:
    # Role rows are re-seeded by the original role-table migration data on
    # fresh installs; removed rows are not restored here by design.
    pass