import { MigrationInterface, QueryRunner } from 'typeorm';

/**
 * CreateSecurityIpLogTables - Security IP logging for law enforcement compliance
 *
 * Creates two tables:
 * 1. security_ip_log - Raw IP storage with 90-day retention
 * 2. security_audit_log - Audit trail for all IP log queries
 *
 * Legal Basis:
 * - GDPR Article 6(1)(c): Legal obligation (law enforcement cooperation)
 * - GDPR Article 6(1)(f): Legitimate interest (fraud prevention)
 */
export class CreateSecurityIpLogTables1738096800000 implements MigrationInterface {
  name = 'CreateSecurityIpLogTables1738096800000';

  public async up(queryRunner: QueryRunner): Promise<void> {
    // Create security_ip_log table
    await queryRunner.query(`
      CREATE TABLE security_ip_log (
        id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
        ip_address INET NOT NULL,
        session_id VARCHAR(64) NOT NULL,
        user_id VARCHAR(255),
        request_path VARCHAR(500) NOT NULL,
        request_method VARCHAR(10) NOT NULL,
        user_agent VARCHAR(500),
        timestamp TIMESTAMPTZ NOT NULL,
        created_at TIMESTAMPTZ DEFAULT NOW()
      )
    `);

    // Create indexes for security_ip_log
    await queryRunner.query(`
      CREATE INDEX idx_security_ip_log_timestamp ON security_ip_log(timestamp)
    `);
    await queryRunner.query(`
      CREATE INDEX idx_security_ip_log_ip ON security_ip_log(ip_address)
    `);
    await queryRunner.query(`
      CREATE INDEX idx_security_ip_log_session ON security_ip_log(session_id)
    `);
    await queryRunner.query(`
      CREATE INDEX idx_security_ip_log_user ON security_ip_log(user_id)
    `);

    // Create security_audit_log table
    await queryRunner.query(`
      CREATE TABLE security_audit_log (
        id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
        action VARCHAR(100) NOT NULL,
        admin_id VARCHAR(255) NOT NULL,
        admin_email VARCHAR(255),
        details JSONB NOT NULL,
        timestamp TIMESTAMPTZ NOT NULL,
        created_at TIMESTAMPTZ DEFAULT NOW()
      )
    `);

    // Create indexes for security_audit_log
    await queryRunner.query(`
      CREATE INDEX idx_security_audit_log_action ON security_audit_log(action)
    `);
    await queryRunner.query(`
      CREATE INDEX idx_security_audit_log_admin ON security_audit_log(admin_id)
    `);
    await queryRunner.query(`
      CREATE INDEX idx_security_audit_log_timestamp ON security_audit_log(timestamp)
    `);

    // Add comment for documentation
    await queryRunner.query(`
      COMMENT ON TABLE security_ip_log IS 'Raw IP storage for law enforcement requests. GDPR Article 6(1)(c) legal obligation + Article 6(1)(f) legitimate interest. 90-day retention.'
    `);
    await queryRunner.query(`
      COMMENT ON TABLE security_audit_log IS 'Audit trail for all security_ip_log queries. Every access is logged for compliance verification.'
    `);
  }

  public async down(queryRunner: QueryRunner): Promise<void> {
    // Drop indexes
    await queryRunner.query(`DROP INDEX IF EXISTS idx_security_audit_log_timestamp`);
    await queryRunner.query(`DROP INDEX IF EXISTS idx_security_audit_log_admin`);
    await queryRunner.query(`DROP INDEX IF EXISTS idx_security_audit_log_action`);
    await queryRunner.query(`DROP INDEX IF EXISTS idx_security_ip_log_user`);
    await queryRunner.query(`DROP INDEX IF EXISTS idx_security_ip_log_session`);
    await queryRunner.query(`DROP INDEX IF EXISTS idx_security_ip_log_ip`);
    await queryRunner.query(`DROP INDEX IF EXISTS idx_security_ip_log_timestamp`);

    // Drop tables
    await queryRunner.query(`DROP TABLE IF EXISTS security_audit_log`);
    await queryRunner.query(`DROP TABLE IF EXISTS security_ip_log`);
  }
}
