-- Enable Row-Level Security (RLS) for Supabase Strands Session Manager
--
-- IMPORTANT: This migration provides EXAMPLE policies for a common use case
-- where session_id corresponds to a user's ID from Supabase Auth.
--
-- You MUST customize these policies based on your authentication strategy:
-- - If using Supabase Auth: Adjust the auth.uid() checks to match your user ID pattern
-- - If using custom auth: Add a user_id column and update policies accordingly
-- - If using org/team isolation: Join to an organizations table in policies
--
-- WARNING: Enabling RLS will affect all database operations. Test thoroughly
-- before deploying to production.

-- Enable Row-Level Security on all tables
ALTER TABLE sessions ENABLE ROW LEVEL SECURITY;
ALTER TABLE agents ENABLE ROW LEVEL SECURITY;
ALTER TABLE messages ENABLE ROW LEVEL SECURITY;

-- ============================================================================
-- EXAMPLE POLICIES - Customize based on your authentication setup
-- ============================================================================

-- Sessions Table: Users can only access their own sessions
-- Assumption: session_id equals the user's auth.uid()
CREATE POLICY "Users can access own sessions" ON sessions
    FOR ALL
    USING (auth.uid()::text = session_id);

-- Agents Table: Users can only access agents in their sessions
CREATE POLICY "Users can access own agents" ON agents
    FOR ALL
    USING (session_id IN (
        SELECT session_id FROM sessions WHERE auth.uid()::text = session_id
    ));

-- Messages Table: Users can only access messages in their sessions
CREATE POLICY "Users can access own messages" ON messages
    FOR ALL
    USING (session_id IN (
        SELECT session_id FROM sessions WHERE auth.uid()::text = session_id
    ));

-- ============================================================================
-- Alternative Policy Examples (commented out - uncomment and modify as needed)
-- ============================================================================

-- Example 1: If you added a user_id column to sessions:
-- CREATE POLICY "Users can access own sessions" ON sessions
--     FOR ALL
--     USING (user_id = auth.uid());

-- Example 2: For service account pattern (backend only):
-- CREATE POLICY "Service role can access all" ON sessions
--     FOR ALL
--     TO service_role
--     USING (true);

-- Example 3: For shared/team sessions with a sessions_users join table:
-- CREATE POLICY "Users can access shared sessions" ON sessions
--     FOR ALL
--     USING (session_id IN (
--         SELECT session_id FROM sessions_users WHERE user_id = auth.uid()
--     ));

-- Example 4: Read-only access for analysts role:
-- CREATE POLICY "Analysts can read all sessions" ON sessions
--     FOR SELECT
--     TO analyst_role
--     USING (true);

-- ============================================================================
-- Testing Your RLS Policies
-- ============================================================================

-- To test policies as a specific user, run in psql or SQL editor:
--
-- SET LOCAL role authenticated;
-- SET LOCAL request.jwt.claims = '{"sub": "user-123"}';
--
-- SELECT * FROM sessions;        -- Should only show user-123's data
-- SELECT * FROM agents;          -- Should only show user-123's agents
-- SELECT * FROM messages;        -- Should only show user-123's messages
--
-- To reset:
-- RESET role;

-- ============================================================================
-- Migration Complete
-- ============================================================================

-- Verify RLS is enabled:
SELECT tablename, rowsecurity
FROM pg_tables
WHERE schemaname = 'public'
  AND tablename IN ('sessions', 'agents', 'messages');

-- Expected output:
--  tablename  | rowsecurity
-- ------------+-------------
--  sessions   | t
--  agents     | t
--  messages   | t
