-- Base table grants for the API roles. The Supabase CLI's current default
-- (auto_expose_new_tables unset) no longer auto-grants table privileges to
-- anon/authenticated/service_role, so without these GRANTs the RLS policies
-- from the initial schema migration are unreachable (every request fails at
-- the privilege check before RLS is even evaluated). This is the documented
-- "explicit grants + RLS" pattern Supabase recommends going forward; the
-- actual access is still fully governed by each table's RLS policies.
grant select, insert, update, delete on
  public.products,
  public.services,
  public.schedule_template,
  public.schedule_exceptions,
  public.bookings,
  public.booked_slots,
  public.inquiries
to anon, authenticated, service_role;

-- Keeps the public, PII-free booked_slots table in sync whenever a booking
-- is created. security definer + explicit search_path per Supabase's
-- documented safe pattern for definer functions.

create or replace function public.sync_booked_slot()
returns trigger
language plpgsql
security definer
set search_path = ''
as $$
begin
  insert into public.booked_slots (date, time)
  values (new.date, new.time)
  on conflict do nothing;
  return new;
end;
$$;

create trigger booking_created_sync_slot
  after insert on public.bookings
  for each row
  execute function public.sync_booked_slot();