-- Creatives multi-tenant (Supabase)
-- Run in SQL editor after reviewing names against existing schema.

create table if not exists public.creatives (
  id uuid primary key default gen_random_uuid(),
  tenant_id uuid not null references public.tenants(id) on delete cascade,
  title text not null,
  status text not null default 'draft'
    check (status in ('draft', 'in_review', 'approved', 'rejected')),
  mime_type text,
  storage_path text,
  bytes int,
  sha256 text,
  created_by uuid references auth.users(id),
  created_at timestamptz not null default now(),
  updated_at timestamptz not null default now()
);

create index if not exists creatives_tenant_idx on public.creatives (tenant_id, updated_at desc);

alter table public.creatives enable row level security;

-- Adjust JWT claim path to match your Auth Hooks
create policy creatives_tenant_select on public.creatives
  for select using (
    tenant_id::text = coalesce(
      auth.jwt() -> 'app_metadata' ->> 'tenant_id',
      auth.jwt() -> 'user_metadata' ->> 'tenant_id'
    )
  );

create policy creatives_tenant_insert on public.creatives
  for insert with check (
    tenant_id::text = coalesce(
      auth.jwt() -> 'app_metadata' ->> 'tenant_id',
      auth.jwt() -> 'user_metadata' ->> 'tenant_id'
    )
  );

create policy creatives_tenant_update on public.creatives
  for update using (
    tenant_id::text = coalesce(
      auth.jwt() -> 'app_metadata' ->> 'tenant_id',
      auth.jwt() -> 'user_metadata' ->> 'tenant_id'
    )
  );

-- Storage bucket suggestion: creatives (private), path = {tenant_id}/{id}