-- Idempotent: enable RLS + tenant policies on agent_runs
-- Safe to re-run.

alter table public.agent_runs enable row level security;

drop policy if exists agent_runs_tenant_select on public.agent_runs;
drop policy if exists agent_runs_tenant_insert on public.agent_runs;
drop policy if exists agent_runs_tenant_update on public.agent_runs;

create policy agent_runs_tenant_select on public.agent_runs
  for select using (
    tenant_id::text = coalesce(
      auth.jwt() -> 'app_metadata' ->> 'tenant_id',
      auth.jwt() -> 'user_metadata' ->> 'tenant_id'
    )
  );

create policy agent_runs_tenant_insert on public.agent_runs
  for insert with check (
    tenant_id::text = coalesce(
      auth.jwt() -> 'app_metadata' ->> 'tenant_id',
      auth.jwt() -> 'user_metadata' ->> 'tenant_id'
    )
  );

create policy agent_runs_tenant_update on public.agent_runs
  for update using (
    tenant_id::text = coalesce(
      auth.jwt() -> 'app_metadata' ->> 'tenant_id',
      auth.jwt() -> 'user_metadata' ->> 'tenant_id'
    )
  );

-- Verify
select c.relname, c.relrowsecurity
from pg_class c
join pg_namespace n on n.oid = c.relnamespace
where n.nspname = 'public' and c.relname = 'agent_runs';