-- Close RLS gap from migration 1 + revoke MV API exposure.
-- Ownership policies follow the natural chain: session owner cascades to
-- entries → sets → reps → rom_estimates → raw_motion_samples.

-- ============================================================================
-- workout_sessions: own row
-- ============================================================================
ALTER TABLE workout_sessions ENABLE ROW LEVEL SECURITY;

CREATE POLICY workout_sessions_own_row ON workout_sessions
  FOR ALL TO authenticated
  USING (user_id = auth.uid())
  WITH CHECK (user_id = auth.uid());

-- ============================================================================
-- exercise_entries: via session
-- ============================================================================
ALTER TABLE exercise_entries ENABLE ROW LEVEL SECURITY;

CREATE POLICY exercise_entries_via_session ON exercise_entries
  FOR ALL TO authenticated
  USING (EXISTS (
    SELECT 1 FROM workout_sessions ws
    WHERE ws.id = exercise_entries.session_id
      AND ws.user_id = auth.uid()
  ))
  WITH CHECK (EXISTS (
    SELECT 1 FROM workout_sessions ws
    WHERE ws.id = exercise_entries.session_id
      AND ws.user_id = auth.uid()
  ));

-- ============================================================================
-- exercise_sets: via entry → session
-- ============================================================================
ALTER TABLE exercise_sets ENABLE ROW LEVEL SECURITY;

CREATE POLICY exercise_sets_via_entry ON exercise_sets
  FOR ALL TO authenticated
  USING (EXISTS (
    SELECT 1 FROM exercise_entries ee
    JOIN workout_sessions ws ON ws.id = ee.session_id
    WHERE ee.id = exercise_sets.entry_id
      AND ws.user_id = auth.uid()
  ))
  WITH CHECK (EXISTS (
    SELECT 1 FROM exercise_entries ee
    JOIN workout_sessions ws ON ws.id = ee.session_id
    WHERE ee.id = exercise_sets.entry_id
      AND ws.user_id = auth.uid()
  ));

-- ============================================================================
-- reps: via set → entry → session
-- ============================================================================
ALTER TABLE reps ENABLE ROW LEVEL SECURITY;

CREATE POLICY reps_via_set ON reps
  FOR ALL TO authenticated
  USING (EXISTS (
    SELECT 1 FROM exercise_sets es
    JOIN exercise_entries ee ON ee.id = es.entry_id
    JOIN workout_sessions ws ON ws.id = ee.session_id
    WHERE es.id = reps.set_id
      AND ws.user_id = auth.uid()
  ))
  WITH CHECK (EXISTS (
    SELECT 1 FROM exercise_sets es
    JOIN exercise_entries ee ON ee.id = es.entry_id
    JOIN workout_sessions ws ON ws.id = ee.session_id
    WHERE es.id = reps.set_id
      AND ws.user_id = auth.uid()
  ));

-- ============================================================================
-- rom_estimates: via entry → session
-- ============================================================================
ALTER TABLE rom_estimates ENABLE ROW LEVEL SECURITY;

CREATE POLICY rom_estimates_via_entry ON rom_estimates
  FOR ALL TO authenticated
  USING (EXISTS (
    SELECT 1 FROM exercise_entries ee
    JOIN workout_sessions ws ON ws.id = ee.session_id
    WHERE ee.id = rom_estimates.entry_id
      AND ws.user_id = auth.uid()
  ))
  WITH CHECK (EXISTS (
    SELECT 1 FROM exercise_entries ee
    JOIN workout_sessions ws ON ws.id = ee.session_id
    WHERE ee.id = rom_estimates.entry_id
      AND ws.user_id = auth.uid()
  ));

-- ============================================================================
-- raw_motion_samples: via session
-- ============================================================================
ALTER TABLE raw_motion_samples ENABLE ROW LEVEL SECURITY;

CREATE POLICY raw_motion_samples_via_session ON raw_motion_samples
  FOR ALL TO authenticated
  USING (EXISTS (
    SELECT 1 FROM workout_sessions ws
    WHERE ws.id = raw_motion_samples.session_id
      AND ws.user_id = auth.uid()
  ))
  WITH CHECK (EXISTS (
    SELECT 1 FROM workout_sessions ws
    WHERE ws.id = raw_motion_samples.session_id
      AND ws.user_id = auth.uid()
  ));

-- ============================================================================
-- centers: authenticated read, no public write
-- (B2B admin write policy TBD — placeholder read-only for now)
-- ============================================================================
ALTER TABLE centers ENABLE ROW LEVEL SECURITY;

CREATE POLICY centers_authenticated_read ON centers
  FOR SELECT TO authenticated USING (true);

-- ============================================================================
-- center_memberships: own row + visible to same-center members
-- ============================================================================
ALTER TABLE center_memberships ENABLE ROW LEVEL SECURITY;

CREATE POLICY center_memberships_self_read ON center_memberships
  FOR SELECT TO authenticated
  USING (user_id = auth.uid());

-- ============================================================================
-- user_daily_load materialized view: revoke API access (anon + authenticated)
-- ============================================================================
REVOKE SELECT ON public.user_daily_load FROM anon, authenticated;
