-- Enable RLS on app_config (fixes Supabase "public table without RLS" warning)
-- app_config: key-value store for scan_base_url etc.; used by authenticated CRM users

ALTER TABLE app_config ENABLE ROW LEVEL SECURITY;

-- Authenticated CRM users can read config (load dashboard, generate QR)
CREATE POLICY "app_config_select" ON app_config
  FOR SELECT USING (auth.role() = 'authenticated');

-- Authenticated CRM users can upsert (save scan URL in QR settings)
CREATE POLICY "app_config_insert" ON app_config
  FOR INSERT WITH CHECK (auth.role() = 'authenticated');

CREATE POLICY "app_config_update" ON app_config
  FOR UPDATE USING (auth.role() = 'authenticated');
