-- Replace exclusive blacklist/whitelist with default_action (accept|drop).
-- Unified kernel chain: deny → allow → default_action.

PRAGMA foreign_keys = OFF;

CREATE TABLE agents_v3 (
  id TEXT PRIMARY KEY,
  name TEXT NOT NULL,
  hostname TEXT,
  platform TEXT NOT NULL DEFAULT 'linux',
  token_prefix TEXT NOT NULL,
  token_hash TEXT NOT NULL,
  status TEXT NOT NULL DEFAULT 'pending',
  default_action TEXT NOT NULL DEFAULT 'accept',
  policy_generation INTEGER NOT NULL DEFAULT 1,
  last_seen_at TEXT,
  last_seen_ip TEXT,
  last_apply_at TEXT,
  last_apply_status TEXT,
  last_apply_error TEXT,
  last_apply_prefix_count INTEGER DEFAULT 0,
  last_apply_packets_dropped INTEGER NOT NULL DEFAULT 0,
  last_apply_packets_accepted INTEGER NOT NULL DEFAULT 0,
  last_apply_kernel_method TEXT,
  client_version TEXT,
  settings_json TEXT NOT NULL DEFAULT '{}',
  created_by_user_id TEXT,
  created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
  approved_at TEXT,
  revoked_at TEXT,
  CHECK (status IN ('invited', 'pending', 'approved', 'revoked')),
  CHECK (platform IN ('linux', 'mikrotik')),
  CHECK (default_action IN ('accept', 'drop')),
  CHECK (length(trim(name)) > 0)
);

INSERT INTO agents_v3 (
  id, name, hostname, platform, token_prefix, token_hash, status, default_action,
  policy_generation, last_seen_at, last_seen_ip, last_apply_at, last_apply_status,
  last_apply_error, last_apply_prefix_count, last_apply_packets_dropped,
  last_apply_packets_accepted, last_apply_kernel_method, client_version,
  settings_json, created_by_user_id, created_at, approved_at, revoked_at
)
SELECT
  id, name, hostname, platform, token_prefix, token_hash, status,
  CASE
    WHEN policy_mode = 'whitelist' THEN 'drop'
    WHEN policy_mode = 'drop' THEN 'drop'
    WHEN policy_mode = 'accept' THEN 'accept'
    ELSE 'accept'
  END,
  policy_generation, last_seen_at, last_seen_ip, last_apply_at, last_apply_status,
  last_apply_error, last_apply_prefix_count, last_apply_packets_dropped,
  last_apply_packets_accepted, last_apply_kernel_method, client_version,
  settings_json, created_by_user_id, created_at, approved_at, revoked_at
FROM agents;

DROP TABLE agents;
ALTER TABLE agents_v3 RENAME TO agents;

CREATE UNIQUE INDEX IF NOT EXISTS idx_agents_token_hash ON agents (token_hash);
CREATE INDEX IF NOT EXISTS idx_agents_status ON agents (status);

PRAGMA foreign_keys = ON;