-- +goose Up
CREATE TABLE candidate_observation_identities (
    candidate_key TEXT PRIMARY KEY NOT NULL
        CHECK (
            length(candidate_key) = 64
            AND candidate_key NOT GLOB '*[^0-9a-f]*'
        ),
    execution_id TEXT NOT NULL,
    candidate_ordinal INTEGER NOT NULL,
    card_signature TEXT NOT NULL
        CHECK (
            length(card_signature) = 64
            AND card_signature NOT GLOB '*[^0-9a-f]*'
        ),
    detail_signature TEXT NOT NULL
        CHECK (
            length(detail_signature) = 64
            AND detail_signature NOT GLOB '*[^0-9a-f]*'
        ),
    detail_evidence_sha256 TEXT NOT NULL
        CHECK (
            length(detail_evidence_sha256) = 64
            AND detail_evidence_sha256 NOT GLOB '*[^0-9a-f]*'
        ),
    specification_evidence_sha256 TEXT NOT NULL
        CHECK (
            length(specification_evidence_sha256) = 64
            AND specification_evidence_sha256 NOT GLOB '*[^0-9a-f]*'
        ),
    identity_version INTEGER NOT NULL
        CHECK (identity_version = 1),
    created_at TEXT NOT NULL,
    UNIQUE (execution_id, candidate_ordinal),
    FOREIGN KEY (execution_id, candidate_ordinal)
        REFERENCES candidate_observations(execution_id, ordinal)
            ON UPDATE RESTRICT ON DELETE CASCADE
);

-- +goose Down
CREATE TEMP TABLE candidate_identities_v7_down_guard (
    allowed INTEGER NOT NULL
        CHECK (allowed = 1)
);

INSERT INTO candidate_identities_v7_down_guard (allowed)
SELECT CASE
    WHEN EXISTS (SELECT 1 FROM candidate_observation_identities)
    THEN 0
    ELSE 1
END;

DROP TABLE candidate_identities_v7_down_guard;
DROP TABLE candidate_observation_identities;