
-- 1. Restrict public-read tables to authenticated users only
DROP POLICY IF EXISTS "Anyone can view agent settings" ON public.agent_settings;
CREATE POLICY "Authenticated can view agent settings"
ON public.agent_settings FOR SELECT TO authenticated USING (true);

DROP POLICY IF EXISTS "Anyone can read api_registry" ON public.api_registry;
CREATE POLICY "Authenticated can read api_registry"
ON public.api_registry FOR SELECT TO authenticated USING (true);

DROP POLICY IF EXISTS "Anyone can read genui_components" ON public.genui_components;
CREATE POLICY "Authenticated can read genui_components"
ON public.genui_components FOR SELECT TO authenticated USING (true);

DROP POLICY IF EXISTS "Anyone can read agent_roles" ON public.agent_roles;
CREATE POLICY "Authenticated can read agent_roles"
ON public.agent_roles FOR SELECT TO authenticated USING (true);

-- 2. SMS verification codes: stop storing plaintext.
--    Verification actually goes through Aliyun DYPNS CheckSmsVerifyCode API;
--    this table only tracks send rate-limit. Make `code` nullable so the
--    Edge Function can persist NULL instead of the real code.
ALTER TABLE public.sms_verification_codes ALTER COLUMN code DROP NOT NULL;

-- Wipe any historical plaintext codes immediately.
UPDATE public.sms_verification_codes SET code = NULL WHERE code IS NOT NULL;
