defmodule Towerops.Repo.Migrations.EncryptMikrotikUsernames do
  use Ecto.Migration

  def up do
    # Change mikrotik_username from string to binary for encryption
    # Note: This will clear any existing usernames since we're moving from
    # plaintext string to encrypted binary. Users will need to re-enter credentials.

    # Organizations
    execute "ALTER TABLE organizations ALTER COLUMN mikrotik_username TYPE bytea USING NULL"

    # Sites
    execute "ALTER TABLE sites ALTER COLUMN mikrotik_username TYPE bytea USING NULL"

    # Devices
    execute "ALTER TABLE devices ALTER COLUMN mikrotik_username TYPE bytea USING NULL"
  end

  def down do
    # Revert back to string type
    # Note: Encrypted data will be cleared when reverting

    # Organizations
    execute "ALTER TABLE organizations ALTER COLUMN mikrotik_username TYPE varchar USING NULL"

    # Sites
    execute "ALTER TABLE sites ALTER COLUMN mikrotik_username TYPE varchar USING NULL"

    # Devices
    execute "ALTER TABLE devices ALTER COLUMN mikrotik_username TYPE varchar USING NULL"
  end
end
