-- Allow anon to SELECT from lookup tables (dropdowns)
-- When Supabase Auth0 JWT isn't configured, CRM uses anon client - RLS was blocking these reads
-- Lookup tables (industries, corporate_statuses, etc.) are non-sensitive reference data

-- Drop existing policies (old names and new split names - idempotent)
DROP POLICY IF EXISTS "rls_industries" ON industries;
DROP POLICY IF EXISTS "rls_industries_select" ON industries;
DROP POLICY IF EXISTS "rls_industries_insert" ON industries;
DROP POLICY IF EXISTS "rls_industries_update" ON industries;
DROP POLICY IF EXISTS "rls_industries_delete" ON industries;

DROP POLICY IF EXISTS "rls_corporate_statuses" ON corporate_statuses;
DROP POLICY IF EXISTS "rls_corporate_statuses_select" ON corporate_statuses;
DROP POLICY IF EXISTS "rls_corporate_statuses_insert" ON corporate_statuses;
DROP POLICY IF EXISTS "rls_corporate_statuses_update" ON corporate_statuses;
DROP POLICY IF EXISTS "rls_corporate_statuses_delete" ON corporate_statuses;

DROP POLICY IF EXISTS "rls_designations" ON designations;
DROP POLICY IF EXISTS "rls_designations_select" ON designations;
DROP POLICY IF EXISTS "rls_designations_insert" ON designations;
DROP POLICY IF EXISTS "rls_designations_update" ON designations;
DROP POLICY IF EXISTS "rls_designations_delete" ON designations;

DROP POLICY IF EXISTS "rls_lead_sources" ON lead_sources;
DROP POLICY IF EXISTS "rls_lead_sources_select" ON lead_sources;
DROP POLICY IF EXISTS "rls_lead_sources_insert" ON lead_sources;
DROP POLICY IF EXISTS "rls_lead_sources_update" ON lead_sources;
DROP POLICY IF EXISTS "rls_lead_sources_delete" ON lead_sources;

DROP POLICY IF EXISTS "rls_locations" ON locations;
DROP POLICY IF EXISTS "rls_locations_select" ON locations;
DROP POLICY IF EXISTS "rls_locations_insert" ON locations;
DROP POLICY IF EXISTS "rls_locations_update" ON locations;
DROP POLICY IF EXISTS "rls_locations_delete" ON locations;

DROP POLICY IF EXISTS "rls_followup_statuses" ON followup_statuses;
DROP POLICY IF EXISTS "rls_followup_statuses_select" ON followup_statuses;
DROP POLICY IF EXISTS "rls_followup_statuses_insert" ON followup_statuses;
DROP POLICY IF EXISTS "rls_followup_statuses_update" ON followup_statuses;
DROP POLICY IF EXISTS "rls_followup_statuses_delete" ON followup_statuses;

DROP POLICY IF EXISTS "rls_opportunity_stages" ON opportunity_stages;
DROP POLICY IF EXISTS "rls_opportunity_stages_select" ON opportunity_stages;
DROP POLICY IF EXISTS "rls_opportunity_stages_insert" ON opportunity_stages;
DROP POLICY IF EXISTS "rls_opportunity_stages_update" ON opportunity_stages;
DROP POLICY IF EXISTS "rls_opportunity_stages_delete" ON opportunity_stages;

DROP POLICY IF EXISTS "rls_seminar_modes" ON seminar_modes;
DROP POLICY IF EXISTS "rls_seminar_modes_select" ON seminar_modes;
DROP POLICY IF EXISTS "rls_seminar_modes_insert" ON seminar_modes;
DROP POLICY IF EXISTS "rls_seminar_modes_update" ON seminar_modes;
DROP POLICY IF EXISTS "rls_seminar_modes_delete" ON seminar_modes;

DROP POLICY IF EXISTS "rls_user_roles" ON user_roles;
DROP POLICY IF EXISTS "rls_user_roles_select" ON user_roles;
DROP POLICY IF EXISTS "rls_user_roles_insert" ON user_roles;
DROP POLICY IF EXISTS "rls_user_roles_update" ON user_roles;
DROP POLICY IF EXISTS "rls_user_roles_delete" ON user_roles;

-- industries: anon can SELECT (dropdown), authenticated for write
CREATE POLICY "rls_industries_select" ON industries FOR SELECT USING (true);
CREATE POLICY "rls_industries_insert" ON industries FOR INSERT WITH CHECK (auth.role() = 'authenticated');
CREATE POLICY "rls_industries_update" ON industries FOR UPDATE USING (auth.role() = 'authenticated');
CREATE POLICY "rls_industries_delete" ON industries FOR DELETE USING (auth.role() = 'authenticated');

-- corporate_statuses
CREATE POLICY "rls_corporate_statuses_select" ON corporate_statuses FOR SELECT USING (true);
CREATE POLICY "rls_corporate_statuses_insert" ON corporate_statuses FOR INSERT WITH CHECK (auth.role() = 'authenticated');
CREATE POLICY "rls_corporate_statuses_update" ON corporate_statuses FOR UPDATE USING (auth.role() = 'authenticated');
CREATE POLICY "rls_corporate_statuses_delete" ON corporate_statuses FOR DELETE USING (auth.role() = 'authenticated');

-- designations
CREATE POLICY "rls_designations_select" ON designations FOR SELECT USING (true);
CREATE POLICY "rls_designations_insert" ON designations FOR INSERT WITH CHECK (auth.role() = 'authenticated');
CREATE POLICY "rls_designations_update" ON designations FOR UPDATE USING (auth.role() = 'authenticated');
CREATE POLICY "rls_designations_delete" ON designations FOR DELETE USING (auth.role() = 'authenticated');

-- lead_sources
CREATE POLICY "rls_lead_sources_select" ON lead_sources FOR SELECT USING (true);
CREATE POLICY "rls_lead_sources_insert" ON lead_sources FOR INSERT WITH CHECK (auth.role() = 'authenticated');
CREATE POLICY "rls_lead_sources_update" ON lead_sources FOR UPDATE USING (auth.role() = 'authenticated');
CREATE POLICY "rls_lead_sources_delete" ON lead_sources FOR DELETE USING (auth.role() = 'authenticated');

-- locations
CREATE POLICY "rls_locations_select" ON locations FOR SELECT USING (true);
CREATE POLICY "rls_locations_insert" ON locations FOR INSERT WITH CHECK (auth.role() = 'authenticated');
CREATE POLICY "rls_locations_update" ON locations FOR UPDATE USING (auth.role() = 'authenticated');
CREATE POLICY "rls_locations_delete" ON locations FOR DELETE USING (auth.role() = 'authenticated');

-- followup_statuses
CREATE POLICY "rls_followup_statuses_select" ON followup_statuses FOR SELECT USING (true);
CREATE POLICY "rls_followup_statuses_insert" ON followup_statuses FOR INSERT WITH CHECK (auth.role() = 'authenticated');
CREATE POLICY "rls_followup_statuses_update" ON followup_statuses FOR UPDATE USING (auth.role() = 'authenticated');
CREATE POLICY "rls_followup_statuses_delete" ON followup_statuses FOR DELETE USING (auth.role() = 'authenticated');

-- opportunity_stages
CREATE POLICY "rls_opportunity_stages_select" ON opportunity_stages FOR SELECT USING (true);
CREATE POLICY "rls_opportunity_stages_insert" ON opportunity_stages FOR INSERT WITH CHECK (auth.role() = 'authenticated');
CREATE POLICY "rls_opportunity_stages_update" ON opportunity_stages FOR UPDATE USING (auth.role() = 'authenticated');
CREATE POLICY "rls_opportunity_stages_delete" ON opportunity_stages FOR DELETE USING (auth.role() = 'authenticated');

-- seminar_modes
CREATE POLICY "rls_seminar_modes_select" ON seminar_modes FOR SELECT USING (true);
CREATE POLICY "rls_seminar_modes_insert" ON seminar_modes FOR INSERT WITH CHECK (auth.role() = 'authenticated');
CREATE POLICY "rls_seminar_modes_update" ON seminar_modes FOR UPDATE USING (auth.role() = 'authenticated');
CREATE POLICY "rls_seminar_modes_delete" ON seminar_modes FOR DELETE USING (auth.role() = 'authenticated');

-- user_roles
CREATE POLICY "rls_user_roles_select" ON user_roles FOR SELECT USING (true);
CREATE POLICY "rls_user_roles_insert" ON user_roles FOR INSERT WITH CHECK (auth.role() = 'authenticated');
CREATE POLICY "rls_user_roles_update" ON user_roles FOR UPDATE USING (auth.role() = 'authenticated');
CREATE POLICY "rls_user_roles_delete" ON user_roles FOR DELETE USING (auth.role() = 'authenticated');

-- opportunity_stage_groups (if exists)
DO $$
BEGIN
  IF EXISTS (SELECT 1 FROM pg_tables WHERE tablename = 'opportunity_stage_groups') THEN
    EXECUTE 'DROP POLICY IF EXISTS "rls_opportunity_stage_groups" ON opportunity_stage_groups';
    EXECUTE 'DROP POLICY IF EXISTS "rls_opportunity_stage_groups_select" ON opportunity_stage_groups';
    EXECUTE 'DROP POLICY IF EXISTS "rls_opportunity_stage_groups_insert" ON opportunity_stage_groups';
    EXECUTE 'DROP POLICY IF EXISTS "rls_opportunity_stage_groups_update" ON opportunity_stage_groups';
    EXECUTE 'DROP POLICY IF EXISTS "rls_opportunity_stage_groups_delete" ON opportunity_stage_groups';
    EXECUTE 'CREATE POLICY "rls_opportunity_stage_groups_select" ON opportunity_stage_groups FOR SELECT USING (true)';
    EXECUTE 'CREATE POLICY "rls_opportunity_stage_groups_insert" ON opportunity_stage_groups FOR INSERT WITH CHECK (auth.role() = ''authenticated'')';
    EXECUTE 'CREATE POLICY "rls_opportunity_stage_groups_update" ON opportunity_stage_groups FOR UPDATE USING (auth.role() = ''authenticated'')';
    EXECUTE 'CREATE POLICY "rls_opportunity_stage_groups_delete" ON opportunity_stage_groups FOR DELETE USING (auth.role() = ''authenticated'')';
  END IF;
END $$;
