-- =============================================================================
-- Fix invitations_invitee_read RLS policy
--
-- The previous version (20260419025051_invite_confirmation.sql) used
--   `email = (SELECT email FROM auth.users WHERE id = auth.uid())`
-- Authenticated role lacks SELECT on `auth.users`, so any client query
-- against `pending_invitations` (or center_memberships joins that
-- transitively touch this policy via shared_shop_with_member helpers)
-- failed with 42501 "permission denied for table users". Surfaced as
-- "멤버 로드 실패" on MembersTab for trainers / owners.
--
-- Replace the subselect with `auth.jwt() ->> 'email'` — the email
-- claim is in every JWT, no table read required.
-- =============================================================================

BEGIN;

DROP POLICY IF EXISTS invitations_invitee_read ON pending_invitations;
CREATE POLICY invitations_invitee_read ON pending_invitations
  FOR SELECT TO authenticated
  USING (
    email = (auth.jwt() ->> 'email')::citext
  );

COMMIT;
