from django.db import migrations, models


def encrypt_existing_keys(apps, schema_editor):
    """Store existing e621 API keys encrypted (idempotent)."""
    from apps.accounts.crypto import encrypt_secret

    User = apps.get_model("accounts", "User")
    for user in User.objects.exclude(e621_api_key="").iterator():
        if user.e621_api_key.startswith("enc:"):
            continue
        user.e621_api_key = encrypt_secret(user.e621_api_key)
        user.save(update_fields=["e621_api_key"])


def noop(apps, schema_editor):
    pass


class Migration(migrations.Migration):
    dependencies = [
        ("accounts", "0005_user_preferences"),
    ]

    operations = [
        # Ciphertext is longer than the plaintext key, so widen the column
        # before encrypting existing rows.
        migrations.AlterField(
            model_name="user",
            name="e621_api_key",
            field=models.CharField(blank=True, default="", max_length=400),
        ),
        migrations.RunPython(encrypt_existing_keys, noop),
    ]