-- IAM Hub employee SSO identity, local session revocation and idempotent audit.
-- The production table prefix in this repository is zyt_.

SET @schema_name := DATABASE();

SET @sql := IF(
  (SELECT COUNT(*) FROM information_schema.COLUMNS WHERE TABLE_SCHEMA=@schema_name AND TABLE_NAME='zyt_admin' AND COLUMN_NAME='iam_subject') = 0,
  'ALTER TABLE `zyt_admin` ADD COLUMN `iam_subject` varchar(128) NULL DEFAULT NULL COMMENT ''IAM Hub OIDC subject'' AFTER `work_wechat_userid`',
  'SELECT 1'
);
PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;

SET @sql := IF(
  (SELECT COUNT(*) FROM information_schema.COLUMNS WHERE TABLE_SCHEMA=@schema_name AND TABLE_NAME='zyt_admin' AND COLUMN_NAME='iam_managed') = 0,
  'ALTER TABLE `zyt_admin` ADD COLUMN `iam_managed` tinyint unsigned NOT NULL DEFAULT 0 COMMENT ''IAM Hub managed account'' AFTER `iam_subject`',
  'SELECT 1'
);
PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;

SET @sql := IF(
  (SELECT COUNT(*) FROM information_schema.COLUMNS WHERE TABLE_SCHEMA=@schema_name AND TABLE_NAME='zyt_admin' AND COLUMN_NAME='iam_revoked_at') = 0,
  'ALTER TABLE `zyt_admin` ADD COLUMN `iam_revoked_at` int unsigned NOT NULL DEFAULT 0 COMMENT ''last IAM revocation timestamp'' AFTER `iam_managed`',
  'SELECT 1'
);
PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;

SET @sql := IF(
  (SELECT COUNT(*) FROM information_schema.STATISTICS WHERE TABLE_SCHEMA=@schema_name AND TABLE_NAME='zyt_admin' AND INDEX_NAME='uk_admin_iam_subject') = 0,
  'CREATE UNIQUE INDEX `uk_admin_iam_subject` ON `zyt_admin` (`iam_subject`)',
  'SELECT 1'
);
PREPARE stmt FROM @sql; EXECUTE stmt; DEALLOCATE PREPARE stmt;

CREATE TABLE IF NOT EXISTS `zyt_iam_revocation_event` (
  `id` int unsigned NOT NULL AUTO_INCREMENT,
  `event_id` varchar(64) NOT NULL,
  `iam_subject` varchar(128) NOT NULL,
  `admin_id` int unsigned NOT NULL DEFAULT 0,
  `status` varchar(32) NOT NULL,
  `reason` varchar(500) NOT NULL DEFAULT '',
  `payload` longtext NOT NULL,
  `create_time` int unsigned NOT NULL DEFAULT 0,
  `update_time` int unsigned NOT NULL DEFAULT 0,
  PRIMARY KEY (`id`),
  UNIQUE KEY `uk_iam_revocation_event_id` (`event_id`),
  KEY `idx_iam_revocation_subject` (`iam_subject`),
  KEY `idx_iam_revocation_admin` (`admin_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='IAM Hub revocation delivery audit';