-- VR-P22b · Public API/Webhooks — RLS ROLLOUT ARTIFACT (deferred, NOT in auto-migration)
-- Runtime code scopes by tenantId today; enabling FORCE RLS is coordinated with
-- the restricted runtime role cutover.
--
-- Inverse per table:
--   REVOKE SELECT, INSERT, UPDATE, DELETE ON "<tbl>" FROM hivegrid_app;
--   DROP POLICY IF EXISTS "<tbl>_tenant_isolation" ON "<tbl>";
--   ALTER TABLE "<tbl>" NO FORCE ROW LEVEL SECURITY;
--   ALTER TABLE "<tbl>" DISABLE ROW LEVEL SECURITY;

DO $$
DECLARE
  tbl text;
BEGIN
  FOREACH tbl IN ARRAY ARRAY[
    'PublicIncomingWebhookEndpoint',
    'PublicWebhookIngestionLog',
    'PublicWebhookSubscription',
    'PublicWebhookDeliveryLog'
  ]
  LOOP
    EXECUTE format('ALTER TABLE %I ENABLE ROW LEVEL SECURITY;', tbl);
    EXECUTE format('ALTER TABLE %I FORCE ROW LEVEL SECURITY;', tbl);

    IF NOT EXISTS (
      SELECT 1 FROM pg_policies
      WHERE schemaname = current_schema()
        AND tablename = tbl
        AND policyname = tbl || '_tenant_isolation'
    ) THEN
      EXECUTE format(
        'CREATE POLICY %I ON %I USING ("tenantId" = current_setting(''app.tenant_id'', true)) WITH CHECK ("tenantId" = current_setting(''app.tenant_id'', true));',
        tbl || '_tenant_isolation', tbl
      );
    END IF;

    EXECUTE format('GRANT SELECT, INSERT, UPDATE, DELETE ON %I TO hivegrid_app;', tbl);
  END LOOP;
END
$$;