-- Configuration Provenance Chain Schema
-- Adds immutable hash chain capabilities to existing configuration management

-- Main configs table - Immutable configuration snapshots with hash chain
CREATE TABLE IF NOT EXISTS configs (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    sha256 TEXT UNIQUE NOT NULL,           -- SHA256 hash of complete config
    blake3 TEXT NOT NULL,                  -- BLAKE3 hash for speed (HFT optimization)
    config_json TEXT NOT NULL,             -- Complete config snapshot (JSONB in Postgres)
    applied_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    actor TEXT NOT NULL,                   -- Who applied this config
    change_reason TEXT NOT NULL,           -- Why config was changed
    previous_config_id INTEGER,            -- Hash chain link - NULL for first config
    change_summary TEXT,                   -- What changed (diff summary)
    process_restart_required BOOLEAN DEFAULT FALSE,
    FOREIGN KEY(previous_config_id) REFERENCES configs(id),
    CONSTRAINT unique_chain_link UNIQUE(previous_config_id) -- Ensures single chain
);

-- Process tracking - Which configs are applied to which HFT processes
CREATE TABLE IF NOT EXISTS config_applications (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    config_id INTEGER NOT NULL,
    process_name TEXT NOT NULL,            -- Trading process identifier
    process_id TEXT NOT NULL,              -- PID or container ID
    binary_git_sha TEXT NOT NULL,         -- Git SHA of the running binary
    runtime_checksum TEXT,                -- Binary checksum for verification
    host TEXT NOT NULL,                   -- Hostname where process runs
    applied_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    status TEXT DEFAULT 'applied' CHECK(status IN ('applied', 'failed', 'reverted')),
    FOREIGN KEY(config_id) REFERENCES configs(id)
);

-- Enhanced config_history with provenance chain linking
ALTER TABLE config_history ADD COLUMN config_snapshot_id INTEGER;
ALTER TABLE config_history ADD COLUMN hash_chain_id TEXT;

-- Performance indexes
CREATE INDEX IF NOT EXISTS idx_configs_sha256 ON configs(sha256);
CREATE INDEX IF NOT EXISTS idx_configs_applied_at ON configs(applied_at DESC);
CREATE INDEX IF NOT EXISTS idx_configs_chain ON configs(previous_config_id);
CREATE INDEX IF NOT EXISTS idx_config_applications_process ON config_applications(process_name);
CREATE INDEX IF NOT EXISTS idx_config_applications_config ON config_applications(config_id);
CREATE INDEX IF NOT EXISTS idx_config_applications_applied_at ON config_applications(applied_at DESC);

-- Verification function for hash chain integrity (stored procedure equivalent)
CREATE VIEW config_chain_verification AS
SELECT 
    c.id,
    c.sha256,
    c.applied_at,
    c.actor,
    c.previous_config_id,
    CASE 
        WHEN c.previous_config_id IS NULL THEN 'GENESIS'
        WHEN prev.id IS NOT NULL THEN 'LINKED'
        ELSE 'BROKEN'
    END as chain_status
FROM configs c
LEFT JOIN configs prev ON c.previous_config_id = prev.id
ORDER BY c.id;

-- Audit trail view combining all configuration events
CREATE VIEW config_audit_trail AS
SELECT 
    'config_change' as event_type,
    c.id as config_id,
    c.applied_at as timestamp,
    c.actor,
    c.change_reason as description,
    c.sha256,
    NULL as process_name
FROM configs c
UNION ALL
SELECT 
    'config_applied' as event_type,
    ca.config_id,
    ca.applied_at as timestamp,
    ca.process_name as actor,
    'Applied to ' || ca.process_name || ' on ' || ca.host as description,
    c.sha256,
    ca.process_name
FROM config_applications ca
JOIN configs c ON ca.config_id = c.id
ORDER BY timestamp DESC;