-- Enable RLS on all remaining public CRM tables
-- Fixes Supabase "public table without RLS" warnings
-- Uses same policy as empanelment_forms: authenticated CRM users (Auth0) can access

-- =============================================================================
-- UTILITY / LOOKUP TABLES (read-heavy, authenticated access)
-- =============================================================================
ALTER TABLE user_roles ENABLE ROW LEVEL SECURITY;
ALTER TABLE industries ENABLE ROW LEVEL SECURITY;
ALTER TABLE opportunity_stages ENABLE ROW LEVEL SECURITY;
ALTER TABLE seminar_modes ENABLE ROW LEVEL SECURITY;
ALTER TABLE corporate_statuses ENABLE ROW LEVEL SECURITY;
ALTER TABLE designations ENABLE ROW LEVEL SECURITY;
ALTER TABLE lead_sources ENABLE ROW LEVEL SECURITY;
ALTER TABLE locations ENABLE ROW LEVEL SECURITY;
ALTER TABLE followup_statuses ENABLE ROW LEVEL SECURITY;
ALTER TABLE product_interests ENABLE ROW LEVEL SECURITY;
ALTER TABLE opportunity_stage_groups ENABLE ROW LEVEL SECURITY;

-- =============================================================================
-- MAIN TABLES
-- =============================================================================
ALTER TABLE users ENABLE ROW LEVEL SECURITY;
ALTER TABLE corporates ENABLE ROW LEVEL SECURITY;
ALTER TABLE pocs ENABLE ROW LEVEL SECURITY;
ALTER TABLE branches ENABLE ROW LEVEL SECURITY;
ALTER TABLE opportunities ENABLE ROW LEVEL SECURITY;
ALTER TABLE followups ENABLE ROW LEVEL SECURITY;
ALTER TABLE seminars ENABLE ROW LEVEL SECURITY;
ALTER TABLE qr_sessions ENABLE ROW LEVEL SECURITY;
ALTER TABLE seminar_scans ENABLE ROW LEVEL SECURITY;
ALTER TABLE external_signals ENABLE ROW LEVEL SECURITY;
ALTER TABLE svcrm ENABLE ROW LEVEL SECURITY;

-- =============================================================================
-- POLICIES: Allow authenticated users full access (matches empanelment pattern)
-- =============================================================================
CREATE POLICY "rls_user_roles" ON user_roles FOR ALL USING (auth.role() = 'authenticated');
CREATE POLICY "rls_industries" ON industries FOR ALL USING (auth.role() = 'authenticated');
CREATE POLICY "rls_opportunity_stages" ON opportunity_stages FOR ALL USING (auth.role() = 'authenticated');
CREATE POLICY "rls_seminar_modes" ON seminar_modes FOR ALL USING (auth.role() = 'authenticated');
CREATE POLICY "rls_corporate_statuses" ON corporate_statuses FOR ALL USING (auth.role() = 'authenticated');
CREATE POLICY "rls_designations" ON designations FOR ALL USING (auth.role() = 'authenticated');
CREATE POLICY "rls_lead_sources" ON lead_sources FOR ALL USING (auth.role() = 'authenticated');
CREATE POLICY "rls_locations" ON locations FOR ALL USING (auth.role() = 'authenticated');
CREATE POLICY "rls_followup_statuses" ON followup_statuses FOR ALL USING (auth.role() = 'authenticated');
CREATE POLICY "rls_opportunity_stage_groups" ON opportunity_stage_groups FOR ALL USING (auth.role() = 'authenticated');

-- product_interests: anon can SELECT (scan.html dropdown), authenticated for write
CREATE POLICY "rls_product_interests_select" ON product_interests FOR SELECT USING (true);
CREATE POLICY "rls_product_interests_insert" ON product_interests FOR INSERT WITH CHECK (auth.role() = 'authenticated');
CREATE POLICY "rls_product_interests_update" ON product_interests FOR UPDATE USING (auth.role() = 'authenticated');
CREATE POLICY "rls_product_interests_delete" ON product_interests FOR DELETE USING (auth.role() = 'authenticated');

CREATE POLICY "rls_users" ON users FOR ALL USING (auth.role() = 'authenticated');
CREATE POLICY "rls_corporates" ON corporates FOR ALL USING (auth.role() = 'authenticated');
CREATE POLICY "rls_pocs" ON pocs FOR ALL USING (auth.role() = 'authenticated');
CREATE POLICY "rls_branches" ON branches FOR ALL USING (auth.role() = 'authenticated');
CREATE POLICY "rls_opportunities" ON opportunities FOR ALL USING (auth.role() = 'authenticated');
CREATE POLICY "rls_followups" ON followups FOR ALL USING (auth.role() = 'authenticated');
CREATE POLICY "rls_seminars" ON seminars FOR ALL USING (auth.role() = 'authenticated');

-- qr_sessions: anon can SELECT (scan.html validates QR), authenticated for write
CREATE POLICY "rls_qr_sessions_select" ON qr_sessions FOR SELECT USING (true);
CREATE POLICY "rls_qr_sessions_insert" ON qr_sessions FOR INSERT WITH CHECK (auth.role() = 'authenticated');
CREATE POLICY "rls_qr_sessions_update" ON qr_sessions FOR UPDATE USING (auth.role() = 'authenticated');
CREATE POLICY "rls_qr_sessions_delete" ON qr_sessions FOR DELETE USING (auth.role() = 'authenticated');

-- seminar_scans: anon can INSERT (scan.html form submit), authenticated for read/update/delete
CREATE POLICY "rls_seminar_scans_select" ON seminar_scans FOR SELECT USING (auth.role() = 'authenticated');
CREATE POLICY "rls_seminar_scans_insert" ON seminar_scans FOR INSERT WITH CHECK (true);
CREATE POLICY "rls_seminar_scans_update" ON seminar_scans FOR UPDATE USING (auth.role() = 'authenticated');
CREATE POLICY "rls_seminar_scans_delete" ON seminar_scans FOR DELETE USING (auth.role() = 'authenticated');

CREATE POLICY "rls_external_signals" ON external_signals FOR ALL USING (auth.role() = 'authenticated');
CREATE POLICY "rls_svcrm" ON svcrm FOR ALL USING (auth.role() = 'authenticated');
