-- RLS activation + policies for all FinanceFlow tables
-- Safe to run: server uses service_role (bypasses RLS), client never queries tables directly.

-- ─── Enable RLS ───────────────────────────────────────────────────────────────

ALTER TABLE profiles     ENABLE ROW LEVEL SECURITY;
ALTER TABLE bank_items   ENABLE ROW LEVEL SECURITY;
ALTER TABLE accounts     ENABLE ROW LEVEL SECURITY;
ALTER TABLE transactions ENABLE ROW LEVEL SECURITY;
ALTER TABLE budgets      ENABLE ROW LEVEL SECURITY;

-- ─── profiles ─────────────────────────────────────────────────────────────────

CREATE POLICY "profiles: own row only"
  ON profiles FOR ALL
  USING      (auth.uid() = id)
  WITH CHECK (auth.uid() = id);

-- ─── bank_items ───────────────────────────────────────────────────────────────

CREATE POLICY "bank_items: own rows only"
  ON bank_items FOR ALL
  USING      (auth.uid() = user_id)
  WITH CHECK (auth.uid() = user_id);

-- ─── accounts ─────────────────────────────────────────────────────────────────

CREATE POLICY "accounts: own rows only"
  ON accounts FOR ALL
  USING      (auth.uid() = user_id)
  WITH CHECK (auth.uid() = user_id);

-- ─── transactions ─────────────────────────────────────────────────────────────

CREATE POLICY "transactions: own rows only"
  ON transactions FOR ALL
  USING      (auth.uid() = user_id)
  WITH CHECK (auth.uid() = user_id);

-- ─── budgets ──────────────────────────────────────────────────────────────────

CREATE POLICY "budgets: own rows only"
  ON budgets FOR ALL
  USING      (auth.uid() = user_id)
  WITH CHECK (auth.uid() = user_id);
