-- ============================================================================
-- Run this once in Supabase → SQL Editor. Safe to re-run (idempotent).
--
-- WHY THIS CHANGED: the sync code upserts with on_conflict=user_id,key (and
-- user_id,id). That REQUIRES a unique constraint on those column pairs. The
-- older version of this block created tables keyed only by (key)/(id) and had
-- no user_id at all, so a freshly-created project would fail on the first
-- "Sync now" with a Postgres 42P10 error. This version creates/repairs the
-- schema the code actually expects, and gives every account its own private
-- rows instead of one shared pile.
-- ============================================================================
create table if not exists treeo_store (
  key text,
  data jsonb,
  updated_at timestamptz default now()
);
create table if not exists treeo_people (
  id text,
  name text, company text, category text, nationality text,
  location text, building text, why text, ai_comment text,
  links text, score int, source_report text, tag text,
  status text, verdict text, note text, followup date,
  found_at timestamptz, updated_at timestamptz default now()
);

-- Per-account ownership. auth.uid() is the signed-in user's id, filled in
-- automatically on insert, so the browser never has to send it.
alter table treeo_store  add column if not exists user_id uuid default auth.uid();
alter table treeo_people add column if not exists user_id uuid default auth.uid();

-- Adopt any pre-existing rows that were created before user_id existed.
-- Run while signed in as the account that should own the old data.
update treeo_store  set user_id = auth.uid() where user_id is null;
update treeo_people set user_id = auth.uid() where user_id is null;

-- Drop the old single-column keys, then add the (user_id, ...) uniqueness the
-- upserts need. Two people can now both have a row with the same key/id.
alter table treeo_store  drop constraint if exists treeo_store_pkey;
alter table treeo_people drop constraint if exists treeo_people_pkey;
alter table treeo_store  drop constraint if exists treeo_store_user_key;
alter table treeo_people drop constraint if exists treeo_people_user_id_key;
alter table treeo_store  add constraint treeo_store_user_key    unique (user_id, key);
alter table treeo_people add constraint treeo_people_user_id_key unique (user_id, id);

alter table treeo_store  enable row level security;
alter table treeo_people enable row level security;

-- Real, database-level isolation: you can only ever see and write your own rows.
-- (Replaces the old "anon all" policies, which let any key read everything.)
drop policy if exists "anon all store"  on treeo_store;
drop policy if exists "anon all people" on treeo_people;
drop policy if exists "own store"  on treeo_store;
drop policy if exists "own people" on treeo_people;
create policy "own store"  on treeo_store  for all to authenticated
  using (user_id = auth.uid()) with check (user_id = auth.uid());
create policy "own people" on treeo_people for all to authenticated
  using (user_id = auth.uid()) with check (user_id = auth.uid());

-- ============ TEAM PAGE (optional, additive) — only needed if you use the "Team" nav page ============
-- Two simple, non-tenant tables shared by everyone signed into this Supabase project (there is
-- only one team here — Treeo — so no per-org isolation needed, unlike the multi-tenant SQL that
-- was tried and removed earlier). Nothing in the login flow depends on these tables existing;
-- if you never run this block, the "Team" page just shows a friendly "not set up yet" message.
create table if not exists team_members (
  id uuid primary key default gen_random_uuid(),
  name text not null,
  email text,
  added_by uuid references auth.users,
  created_at timestamptz default now()
);
create table if not exists team_messages (
  id uuid primary key default gen_random_uuid(),
  author_name text not null,
  author_email text,
  text text not null,
  created_at timestamptz default now()
);
alter table team_members enable row level security;
alter table team_messages enable row level security;
-- anyone signed in (any authenticated Supabase user on this project) can read/write both tables —
-- there's no per-org split here, it's one shared team space. Swap `to authenticated` policies for
-- something tighter later if this project ever needs to isolate multiple separate teams.
drop policy if exists "authenticated all team_members" on team_members;
create policy "authenticated all team_members" on team_members for all to authenticated using (true) with check (true);
drop policy if exists "authenticated all team_messages" on team_messages;
create policy "authenticated all team_messages" on team_messages for all to authenticated using (true) with check (true);

-- ============ DIRECT MESSAGES (optional, additive) — private 1:1 messages, real RLS (not just UI-hidden) ============
-- Unlike team_messages (public board, anyone signed in can read all rows), this table is actually
-- restricted at the database level: a row is only selectable by its sender or its recipient. Uses
-- Supabase's built-in auth.email() (the signed-in user's own email from their JWT) — nobody can
-- read someone else's DMs even by calling the REST API directly.
create table if not exists team_dm (
  id uuid primary key default gen_random_uuid(),
  from_email text not null,
  to_email text not null,
  text text not null,
  created_at timestamptz default now()
);
alter table team_dm enable row level security;
drop policy if exists "dm select own" on team_dm;
create policy "dm select own" on team_dm for select to authenticated
  using (from_email = auth.email() or to_email = auth.email());
drop policy if exists "dm insert own" on team_dm;
create policy "dm insert own" on team_dm for insert to authenticated
  with check (from_email = auth.email());