-- Follow-up to the final review of this fast-follow-up branch. The Edge
-- Functions (on-booking-created, on-inquiry-created) already log a failed
-- Resend send via console.error, but Edge Function logs are not something
-- Mira (the salon owner) would ever look at -- a failed notification email
-- was effectively invisible. This table gives failures a place a human
-- could plausibly check (e.g. surfaced later in an admin panel), without
-- making the booking/inquiry request itself fail or retry (see the
-- reasoning in the Edge Functions' try/catch blocks).
create table public.notification_failures (
  id uuid primary key default gen_random_uuid(),
  kind text not null check (kind in ('booking', 'inquiry')),
  record_id uuid not null,
  error_message text not null,
  created_at timestamptz not null default now()
);

alter table public.notification_failures enable row level security;

-- Admin-only select; no insert/update/delete policy exists for anyone --
-- only the Edge Functions' service-role client writes here, and
-- service_role bypasses RLS entirely (same pattern as booked_slots'
-- security-definer-trigger-only write path).
create policy "notification_failures_admin_read" on public.notification_failures
  for select using ((select auth.uid()) = '21c90224-e0b2-412e-a431-8e7f097c1cef'::uuid);

-- No grant to anon at all (these rows can reference booking/inquiry PII via
-- error_message, same protection level as bookings/inquiries themselves).
-- authenticated gets select (narrowed to the admin UID by the RLS policy
-- above); only service_role can write.
grant select on public.notification_failures to authenticated;
grant select, insert, update, delete on public.notification_failures to service_role;