-- RLS checklist — run in Supabase SQL editor as postgres
-- Goal: prove tenant isolation (no cross-tenant reads)

-- 1) List tables missing RLS
select c.relname as table_name, c.relrowsecurity as rls_enabled
from pg_class c
join pg_namespace n on n.oid = c.relnamespace
where n.nspname = 'public' and c.relkind = 'r'
order by 1;

-- 2) Expected: tenants, users, leads, deals, ad_daily, documents,
--    document_chunks, agent_runs, targets, kpi_weekly (view) …
-- Each business table: ALTER TABLE … ENABLE ROW LEVEL SECURITY;

-- 3) Example policy pattern (adapt column names):
-- create policy tenant_select on public.leads
--   for select using (
--     tenant_id::text = coalesce(
--       auth.jwt() -> 'app_metadata' ->> 'tenant_id',
--       auth.jwt() -> 'user_metadata' ->> 'tenant_id'
--     )
--   );

-- 4) Negative test: login as client A, select count(*) from leads
--    where tenant_id = '<tenant_B>'; must be 0.

-- 5) Service role bypasses RLS — never expose to browser.