-- Run this once in Supabase → SQL Editor:
create table if not exists treeo_store (
  key text primary key,
  data jsonb,
  updated_at timestamptz default now()
);
create table if not exists treeo_people (
  id text primary key,
  name text, company text, category text, nationality text,
  location text, building text, why text, ai_comment text,
  links text, score int, source_report text, tag text,
  status text, verdict text, note text, followup date,
  found_at timestamptz, updated_at timestamptz default now()
);
alter table treeo_store enable row level security;
alter table treeo_people enable row level security;
-- simple policy (single-user; tighten later with auth):
create policy "anon all store" on treeo_store for all using (true) with check (true);
create policy "anon all people" on treeo_people for all using (true) with check (true);

-- ============ MULTI-TENANT UPGRADE (Faz 4) — run when ready to onboard a second org/user ============
-- Adds the user_id/tenant_id columns the sync code already expects (on_conflict=user_id,...) and
-- replaces "anyone with the anon key sees everything" with real per-account isolation. Safe to run
-- alongside existing data. No client code changes needed — Postgres fills these columns automatically
-- from the signed-in user's JWT (default auth.uid()) on every insert.
alter table treeo_store add column if not exists user_id uuid references auth.users default auth.uid();
alter table treeo_store add column if not exists tenant_id uuid default auth.uid();
alter table treeo_people add column if not exists user_id uuid references auth.users default auth.uid();
alter table treeo_people add column if not exists tenant_id uuid default auth.uid();
create unique index if not exists treeo_store_user_key on treeo_store(user_id, key);
create unique index if not exists treeo_people_user_id_idx on treeo_people(user_id, id);

-- profiles table: lets multiple signed-in users (e.g. two partners) share ONE tenant_id as a team account
create table if not exists profiles (
  id uuid primary key references auth.users default auth.uid(),
  tenant_id uuid,
  org_name text,
  role text default 'Partner',
  created_at timestamptz default now()
);
alter table profiles enable row level security;
create policy "user reads own profile" on profiles for select using (id = auth.uid());
create policy "user updates own profile" on profiles for update using (id = auth.uid());

-- when ready to cut over (after confirming every user is signed in, not using the shared anon key):
-- drop policy "anon all store" on treeo_store;
-- drop policy "anon all people" on treeo_people;
create policy "tenant isolation store" on treeo_store for all
  using (tenant_id = coalesce((select p.tenant_id from profiles p where p.id = auth.uid()), auth.uid()))
  with check (tenant_id = coalesce((select p.tenant_id from profiles p where p.id = auth.uid()), auth.uid()));
create policy "tenant isolation people" on treeo_people for all
  using (tenant_id = coalesce((select p.tenant_id from profiles p where p.id = auth.uid()), auth.uid()))
  with check (tenant_id = coalesce((select p.tenant_id from profiles p where p.id = auth.uid()), auth.uid()));