-- 统一 Admin 权限校验：所有依赖 profiles.role='admin' 的 RLS 策略改用 is_admin(auth.uid())
-- 这样 user_roles 表成为权限的唯一真相源（SSOT），消除前端可篡改 profiles.role 带来的提权风险。

-- admin_chat_messages
DROP POLICY IF EXISTS "Admins can create admin chat messages" ON public.admin_chat_messages;
DROP POLICY IF EXISTS "Admins can view admin chat messages" ON public.admin_chat_messages;
CREATE POLICY "Admins can create admin chat messages" ON public.admin_chat_messages
  FOR INSERT WITH CHECK (auth.uid() = user_id AND public.is_admin(auth.uid()));
CREATE POLICY "Admins can view admin chat messages" ON public.admin_chat_messages
  FOR SELECT USING (public.is_admin(auth.uid()));

-- after_sales_requests
DROP POLICY IF EXISTS "Admins can update all after sales requests" ON public.after_sales_requests;
DROP POLICY IF EXISTS "Admins can view all after sales requests" ON public.after_sales_requests;
CREATE POLICY "Admins can update all after sales requests" ON public.after_sales_requests
  FOR UPDATE USING (public.is_admin(auth.uid()));
CREATE POLICY "Admins can view all after sales requests" ON public.after_sales_requests
  FOR SELECT USING (public.is_admin(auth.uid()));

-- agent_context
DROP POLICY IF EXISTS "Admins can view all context" ON public.agent_context;
CREATE POLICY "Admins can view all context" ON public.agent_context
  FOR SELECT USING (public.is_admin(auth.uid()));

-- agent_settings
DROP POLICY IF EXISTS "Admins can manage agent settings" ON public.agent_settings;
CREATE POLICY "Admins can manage agent settings" ON public.agent_settings
  FOR ALL USING (public.is_admin(auth.uid()));

-- balance_transactions
DROP POLICY IF EXISTS "Admins can create transactions" ON public.balance_transactions;
DROP POLICY IF EXISTS "Admins can view all transactions" ON public.balance_transactions;
CREATE POLICY "Admins can create transactions" ON public.balance_transactions
  FOR INSERT WITH CHECK (public.is_admin(auth.uid()));
CREATE POLICY "Admins can view all transactions" ON public.balance_transactions
  FOR SELECT USING (public.is_admin(auth.uid()));

-- banners
DROP POLICY IF EXISTS "Admins can manage banners" ON public.banners;
CREATE POLICY "Admins can manage banners" ON public.banners
  FOR ALL USING (public.is_admin(auth.uid()));

-- brands
DROP POLICY IF EXISTS "Admins can manage brands" ON public.brands;
CREATE POLICY "Admins can manage brands" ON public.brands
  FOR ALL USING (public.is_admin(auth.uid()));

-- business_alerts
DROP POLICY IF EXISTS "Admins can delete alerts" ON public.business_alerts;
DROP POLICY IF EXISTS "Admins can update alerts" ON public.business_alerts;
DROP POLICY IF EXISTS "Admins can view all alerts" ON public.business_alerts;
CREATE POLICY "Admins can delete alerts" ON public.business_alerts
  FOR DELETE USING (public.is_admin(auth.uid()));
CREATE POLICY "Admins can update alerts" ON public.business_alerts
  FOR UPDATE USING (public.is_admin(auth.uid()));
CREATE POLICY "Admins can view all alerts" ON public.business_alerts
  FOR SELECT USING (public.is_admin(auth.uid()));

-- categories
DROP POLICY IF EXISTS "Admins can manage categories" ON public.categories;
CREATE POLICY "Admins can manage categories" ON public.categories
  FOR ALL USING (public.is_admin(auth.uid()));

-- category_brands
DROP POLICY IF EXISTS "Admins can manage category brands" ON public.category_brands;
CREATE POLICY "Admins can manage category brands" ON public.category_brands
  FOR ALL USING (public.is_admin(auth.uid()));

-- context_changes (uses agent_context join, admin variant only)
DROP POLICY IF EXISTS "Admins can view all context changes" ON public.context_changes;
CREATE POLICY "Admins can view all context changes" ON public.context_changes
  FOR SELECT USING (public.is_admin(auth.uid()));

-- coupons
DROP POLICY IF EXISTS "Admins can manage all coupons" ON public.coupons;
CREATE POLICY "Admins can manage all coupons" ON public.coupons
  FOR ALL USING (public.is_admin(auth.uid()));

-- cross_store_promotion_stores
DROP POLICY IF EXISTS "Admins can manage cross store promotion stores" ON public.cross_store_promotion_stores;
CREATE POLICY "Admins can manage cross store promotion stores" ON public.cross_store_promotion_stores
  FOR ALL USING (public.is_admin(auth.uid()));

-- cross_store_promotions
DROP POLICY IF EXISTS "Admins can manage cross store promotions" ON public.cross_store_promotions;
CREATE POLICY "Admins can manage cross store promotions" ON public.cross_store_promotions
  FOR ALL USING (public.is_admin(auth.uid()));

-- flash_sales
DROP POLICY IF EXISTS "Admins can manage flash sales" ON public.flash_sales;
CREATE POLICY "Admins can manage flash sales" ON public.flash_sales
  FOR ALL USING (public.is_admin(auth.uid()));

-- goals
DROP POLICY IF EXISTS "Admins can manage goals" ON public.goals;
CREATE POLICY "Admins can manage goals" ON public.goals
  FOR ALL USING (public.is_admin(auth.uid()));

-- group_buy_activities
DROP POLICY IF EXISTS "Admins can manage group buy activities" ON public.group_buy_activities;
CREATE POLICY "Admins can manage group buy activities" ON public.group_buy_activities
  FOR ALL USING (public.is_admin(auth.uid()));

-- group_buy_members
DROP POLICY IF EXISTS "Admins can manage all group members" ON public.group_buy_members;
CREATE POLICY "Admins can manage all group members" ON public.group_buy_members
  FOR ALL USING (public.is_admin(auth.uid()));

-- group_buy_orders
DROP POLICY IF EXISTS "Admins can manage all group orders" ON public.group_buy_orders;
CREATE POLICY "Admins can manage all group orders" ON public.group_buy_orders
  FOR ALL USING (public.is_admin(auth.uid()));

-- marketing_campaigns
DROP POLICY IF EXISTS "Admins can manage marketing campaigns" ON public.marketing_campaigns;
CREATE POLICY "Admins can manage marketing campaigns" ON public.marketing_campaigns
  FOR ALL USING (public.is_admin(auth.uid()));

-- orders
DROP POLICY IF EXISTS "Admins can update all orders" ON public.orders;
DROP POLICY IF EXISTS "Admins can view all orders" ON public.orders;
CREATE POLICY "Admins can update all orders" ON public.orders
  FOR UPDATE USING (public.is_admin(auth.uid()));
CREATE POLICY "Admins can view all orders" ON public.orders
  FOR SELECT USING (public.is_admin(auth.uid()));

-- order_items
DROP POLICY IF EXISTS "Admins can view all order items" ON public.order_items;
CREATE POLICY "Admins can view all order items" ON public.order_items
  FOR SELECT USING (public.is_admin(auth.uid()));

-- payment_gifts
DROP POLICY IF EXISTS "Admins can manage payment gifts" ON public.payment_gifts;
CREATE POLICY "Admins can manage payment gifts" ON public.payment_gifts
  FOR ALL USING (public.is_admin(auth.uid()));