CREATE TABLE credential_accounts (
    id TEXT PRIMARY KEY,
    provider TEXT NOT NULL CHECK (provider IN ('aws', 'cloudflare')),
    name TEXT NOT NULL CHECK (length(trim(name)) BETWEEN 1 AND 80),
    use_default_aws_credentials INTEGER
        CHECK (use_default_aws_credentials IS NULL OR use_default_aws_credentials IN (0, 1)),
    config_version INTEGER NOT NULL DEFAULT 1 CHECK (config_version > 0),
    created_at TEXT NOT NULL,
    updated_at TEXT NOT NULL,
    archived_at TEXT,
    CHECK (
        (provider = 'aws' AND use_default_aws_credentials IS NOT NULL)
        OR (provider = 'cloudflare' AND use_default_aws_credentials IS NULL)
    )
);

CREATE UNIQUE INDEX uq_credential_accounts_provider_name_active
ON credential_accounts(provider, name COLLATE NOCASE)
WHERE archived_at IS NULL;

CREATE INDEX idx_credential_accounts_active
ON credential_accounts(provider, archived_at, name);

CREATE TABLE account_secrets (
    account_id TEXT NOT NULL
        REFERENCES credential_accounts(id) ON DELETE CASCADE,
    name TEXT NOT NULL CHECK (
        name IN (
            'aws_access_key_id',
            'aws_secret_access_key',
            'aws_session_token',
            'cloudflare_api_token'
        )
    ),
    key_version INTEGER NOT NULL DEFAULT 1 CHECK (key_version > 0),
    nonce TEXT NOT NULL,
    ciphertext TEXT NOT NULL,
    created_at TEXT NOT NULL,
    updated_at TEXT NOT NULL,
    PRIMARY KEY (account_id, name)
);

CREATE INDEX idx_account_secrets_account
ON account_secrets(account_id);

ALTER TABLE managed_instances
ADD COLUMN aws_account_id TEXT
    REFERENCES credential_accounts(id) ON DELETE RESTRICT;

ALTER TABLE managed_instances
ADD COLUMN cloudflare_account_id TEXT
    REFERENCES credential_accounts(id) ON DELETE RESTRICT;

DROP INDEX uq_managed_instances_aws_target_active;

CREATE UNIQUE INDEX uq_managed_instances_aws_target_active
ON managed_instances(
    coalesce(aws_account_id, ''), aws_region, lightsail_instance_name
)
WHERE archived_at IS NULL;

DROP INDEX uq_managed_instances_dns_record_active;

CREATE UNIQUE INDEX uq_managed_instances_dns_record_active
ON managed_instances(
    coalesce(cloudflare_account_id, ''), lower(cloudflare_record_name)
)
WHERE archived_at IS NULL;

CREATE INDEX idx_managed_instances_aws_account
ON managed_instances(aws_account_id)
WHERE archived_at IS NULL;

CREATE INDEX idx_managed_instances_cloudflare_account
ON managed_instances(cloudflare_account_id)
WHERE archived_at IS NULL;

ALTER TABLE fleet_run_items
ADD COLUMN aws_account_id TEXT
    REFERENCES credential_accounts(id) ON DELETE RESTRICT;

ALTER TABLE fleet_run_items
ADD COLUMN cloudflare_account_id TEXT
    REFERENCES credential_accounts(id) ON DELETE RESTRICT;