-- Phase V2-6.1: 3단계 권한 체계 — manager 역할 추가
-- manager: CS 업무 (조회 + 구독 수정/메모)
-- admin: 운영 전권 (구독 CRUD, 삭제, manager 관리)
-- super_admin: admin 계정 관리 (승격/강등)

-- 1. profiles.role CHECK 확장
ALTER TABLE public.profiles DROP CONSTRAINT profiles_role_check;
ALTER TABLE public.profiles
  ADD CONSTRAINT profiles_role_check
  CHECK (role IN ('user', 'manager', 'admin', 'super_admin'));

-- 2. RLS: manager도 읽기 허용
DROP POLICY IF EXISTS admin_read_all_profiles ON public.profiles;
CREATE POLICY admin_read_all_profiles ON public.profiles FOR SELECT
  USING ((auth.jwt() -> 'app_metadata' ->> 'role') IN ('manager', 'admin', 'super_admin'));

DROP POLICY IF EXISTS admin_read_all_subscriptions ON public.subscriptions;
CREATE POLICY admin_read_all_subscriptions ON public.subscriptions FOR SELECT
  USING ((auth.jwt() -> 'app_metadata' ->> 'role') IN ('manager', 'admin', 'super_admin'));

DROP POLICY IF EXISTS admin_read_all_daily_usage ON public.daily_usage;
CREATE POLICY admin_read_all_daily_usage ON public.daily_usage FOR SELECT
  USING ((auth.jwt() -> 'app_metadata' ->> 'role') IN ('manager', 'admin', 'super_admin'));

DROP POLICY IF EXISTS admin_read_audit_log ON public.audit_log;
CREATE POLICY admin_read_audit_log ON public.audit_log FOR SELECT
  USING ((auth.jwt() -> 'app_metadata' ->> 'role') IN ('manager', 'admin', 'super_admin'));

-- 3. RLS: admin도 subscriptions/profiles 쓰기 허용 (기존 super_admin 전용 → admin 이상)
DROP POLICY IF EXISTS super_admin_write_subscriptions ON public.subscriptions;
CREATE POLICY admin_write_subscriptions ON public.subscriptions
  FOR ALL
  USING ((auth.jwt() -> 'app_metadata' ->> 'role') IN ('admin', 'super_admin'))
  WITH CHECK ((auth.jwt() -> 'app_metadata' ->> 'role') IN ('admin', 'super_admin'));

DROP POLICY IF EXISTS super_admin_update_profiles ON public.profiles;
CREATE POLICY admin_update_profiles ON public.profiles
  FOR UPDATE
  USING ((auth.jwt() -> 'app_metadata' ->> 'role') IN ('admin', 'super_admin'))
  WITH CHECK ((auth.jwt() -> 'app_metadata' ->> 'role') IN ('admin', 'super_admin'));

-- 4. RLS: manager는 subscriptions 수정만 허용 (생성/삭제 불가)
-- manager가 UPDATE를 수행할 수 있도록 별도 정책 (위의 admin_write_subscriptions은 admin 이상만)
-- 주의: 위 정책이 FOR ALL이므로 admin/super_admin은 이미 커버. manager만 UPDATE 추가.
CREATE POLICY manager_update_subscriptions ON public.subscriptions
  FOR UPDATE
  USING ((auth.jwt() -> 'app_metadata' ->> 'role') = 'manager')
  WITH CHECK ((auth.jwt() -> 'app_metadata' ->> 'role') = 'manager');