/*
  # Row Level Security Policies
  
  Enables RLS and creates policies for all tables.
  
  ## Security Rules
  - Users can only access their own data
  - Recruiters can view applicant data for their company's jobs
  - Company members can manage their company's resources
  - Public can view published content (jobs, companies, blog)
*/

-- Enable RLS on all tables
ALTER TABLE user_profiles ENABLE ROW LEVEL SECURITY;
ALTER TABLE candidate_profiles ENABLE ROW LEVEL SECURITY;
ALTER TABLE cvs ENABLE ROW LEVEL SECURITY;
ALTER TABLE categories ENABLE ROW LEVEL SECURITY;
ALTER TABLE companies ENABLE ROW LEVEL SECURITY;
ALTER TABLE recruiter_members ENABLE ROW LEVEL SECURITY;
ALTER TABLE jobs ENABLE ROW LEVEL SECURITY;
ALTER TABLE applications ENABLE ROW LEVEL SECURITY;
ALTER TABLE job_favorites ENABLE ROW LEVEL SECURITY;
ALTER TABLE job_alerts ENABLE ROW LEVEL SECURITY;
ALTER TABLE blog_posts ENABLE ROW LEVEL SECURITY;
ALTER TABLE contact_messages ENABLE ROW LEVEL SECURITY;

-- User profiles policies
CREATE POLICY "Users can view own profile"
  ON user_profiles FOR SELECT
  TO authenticated
  USING (auth.uid() = user_id);

CREATE POLICY "Users can update own profile"
  ON user_profiles FOR UPDATE
  TO authenticated
  USING (auth.uid() = user_id)
  WITH CHECK (auth.uid() = user_id);

CREATE POLICY "Users can insert own profile"
  ON user_profiles FOR INSERT
  TO authenticated
  WITH CHECK (auth.uid() = user_id);

-- Candidate profiles policies
CREATE POLICY "Candidates can view own profile"
  ON candidate_profiles FOR SELECT
  TO authenticated
  USING (auth.uid() = user_id);

CREATE POLICY "Candidates can update own profile"
  ON candidate_profiles FOR UPDATE
  TO authenticated
  USING (auth.uid() = user_id)
  WITH CHECK (auth.uid() = user_id);

CREATE POLICY "Candidates can insert own profile"
  ON candidate_profiles FOR INSERT
  TO authenticated
  WITH CHECK (auth.uid() = user_id);

CREATE POLICY "Recruiters can view candidate profiles for applicants"
  ON candidate_profiles FOR SELECT
  TO authenticated
  USING (
    EXISTS (
      SELECT 1 FROM applications a
      INNER JOIN jobs j ON j.id = a.job_id
      INNER JOIN recruiter_members rm ON rm.company_id = j.company_id
      WHERE a.candidate_user_id = candidate_profiles.user_id
      AND rm.user_id = auth.uid()
    )
  );

-- CVs policies
CREATE POLICY "Users can view own CVs"
  ON cvs FOR SELECT
  TO authenticated
  USING (auth.uid() = user_id);

CREATE POLICY "Users can insert own CVs"
  ON cvs FOR INSERT
  TO authenticated
  WITH CHECK (auth.uid() = user_id);

CREATE POLICY "Users can update own CVs"
  ON cvs FOR UPDATE
  TO authenticated
  USING (auth.uid() = user_id)
  WITH CHECK (auth.uid() = user_id);

CREATE POLICY "Users can delete own CVs"
  ON cvs FOR DELETE
  TO authenticated
  USING (auth.uid() = user_id);

CREATE POLICY "Recruiters can view CVs for applicants"
  ON cvs FOR SELECT
  TO authenticated
  USING (
    EXISTS (
      SELECT 1 FROM applications a
      INNER JOIN jobs j ON j.id = a.job_id
      INNER JOIN recruiter_members rm ON rm.company_id = j.company_id
      WHERE a.cv_id = cvs.id
      AND rm.user_id = auth.uid()
    )
  );

-- Categories policies
CREATE POLICY "Anyone can view categories"
  ON categories FOR SELECT
  TO authenticated, anon
  USING (true);

-- Companies policies
CREATE POLICY "Anyone can view verified companies"
  ON companies FOR SELECT
  TO authenticated, anon
  USING (verified = true);

CREATE POLICY "Company members can view their company"
  ON companies FOR SELECT
  TO authenticated
  USING (
    EXISTS (
      SELECT 1 FROM recruiter_members rm
      WHERE rm.company_id = companies.id
      AND rm.user_id = auth.uid()
    )
  );

CREATE POLICY "Company owners can update their company"
  ON companies FOR UPDATE
  TO authenticated
  USING (
    EXISTS (
      SELECT 1 FROM recruiter_members rm
      WHERE rm.company_id = companies.id
      AND rm.user_id = auth.uid()
      AND rm.role = 'OWNER'
    )
  )
  WITH CHECK (
    EXISTS (
      SELECT 1 FROM recruiter_members rm
      WHERE rm.company_id = companies.id
      AND rm.user_id = auth.uid()
      AND rm.role = 'OWNER'
    )
  );

CREATE POLICY "Recruiters can create companies"
  ON companies FOR INSERT
  TO authenticated
  WITH CHECK (
    EXISTS (
      SELECT 1 FROM user_profiles
      WHERE user_id = auth.uid()
      AND role IN ('RECRUITER', 'ADMIN')
    )
  );

-- Recruiter members policies
CREATE POLICY "Company members can view team"
  ON recruiter_members FOR SELECT
  TO authenticated
  USING (
    EXISTS (
      SELECT 1 FROM recruiter_members rm
      WHERE rm.company_id = recruiter_members.company_id
      AND rm.user_id = auth.uid()
    )
  );

CREATE POLICY "Company owners can manage team"
  ON recruiter_members FOR ALL
  TO authenticated
  USING (
    EXISTS (
      SELECT 1 FROM recruiter_members rm
      WHERE rm.company_id = recruiter_members.company_id
      AND rm.user_id = auth.uid()
      AND rm.role = 'OWNER'
    )
  )
  WITH CHECK (
    EXISTS (
      SELECT 1 FROM recruiter_members rm
      WHERE rm.company_id = recruiter_members.company_id
      AND rm.user_id = auth.uid()
      AND rm.role = 'OWNER'
    )
  );

-- Jobs policies
CREATE POLICY "Anyone can view published jobs"
  ON jobs FOR SELECT
  TO authenticated, anon
  USING (status = 'PUBLISHED');

CREATE POLICY "Company members can view their jobs"
  ON jobs FOR SELECT
  TO authenticated
  USING (
    EXISTS (
      SELECT 1 FROM recruiter_members rm
      WHERE rm.company_id = jobs.company_id
      AND rm.user_id = auth.uid()
    )
  );

CREATE POLICY "Company members can create jobs"
  ON jobs FOR INSERT
  TO authenticated
  WITH CHECK (
    EXISTS (
      SELECT 1 FROM recruiter_members rm
      WHERE rm.company_id = jobs.company_id
      AND rm.user_id = auth.uid()
    )
  );

CREATE POLICY "Company members can update their jobs"
  ON jobs FOR UPDATE
  TO authenticated
  USING (
    EXISTS (
      SELECT 1 FROM recruiter_members rm
      WHERE rm.company_id = jobs.company_id
      AND rm.user_id = auth.uid()
    )
  )
  WITH CHECK (
    EXISTS (
      SELECT 1 FROM recruiter_members rm
      WHERE rm.company_id = jobs.company_id
      AND rm.user_id = auth.uid()
    )
  );

CREATE POLICY "Company members can delete their jobs"
  ON jobs FOR DELETE
  TO authenticated
  USING (
    EXISTS (
      SELECT 1 FROM recruiter_members rm
      WHERE rm.company_id = jobs.company_id
      AND rm.user_id = auth.uid()
    )
  );

-- Applications policies
CREATE POLICY "Candidates can view own applications"
  ON applications FOR SELECT
  TO authenticated
  USING (auth.uid() = candidate_user_id);

CREATE POLICY "Candidates can create applications"
  ON applications FOR INSERT
  TO authenticated
  WITH CHECK (auth.uid() = candidate_user_id);

CREATE POLICY "Company members can view applications for their jobs"
  ON applications FOR SELECT
  TO authenticated
  USING (
    EXISTS (
      SELECT 1 FROM jobs j
      INNER JOIN recruiter_members rm ON rm.company_id = j.company_id
      WHERE j.id = applications.job_id
      AND rm.user_id = auth.uid()
    )
  );

CREATE POLICY "Company members can update application status"
  ON applications FOR UPDATE
  TO authenticated
  USING (
    EXISTS (
      SELECT 1 FROM jobs j
      INNER JOIN recruiter_members rm ON rm.company_id = j.company_id
      WHERE j.id = applications.job_id
      AND rm.user_id = auth.uid()
    )
  )
  WITH CHECK (
    EXISTS (
      SELECT 1 FROM jobs j
      INNER JOIN recruiter_members rm ON rm.company_id = j.company_id
      WHERE j.id = applications.job_id
      AND rm.user_id = auth.uid()
    )
  );

-- Job favorites policies
CREATE POLICY "Users can manage own favorites"
  ON job_favorites FOR ALL
  TO authenticated
  USING (auth.uid() = user_id)
  WITH CHECK (auth.uid() = user_id);

-- Job alerts policies
CREATE POLICY "Users can manage own alerts"
  ON job_alerts FOR ALL
  TO authenticated
  USING (auth.uid() = user_id)
  WITH CHECK (auth.uid() = user_id);

-- Blog posts policies
CREATE POLICY "Anyone can view published blog posts"
  ON blog_posts FOR SELECT
  TO authenticated, anon
  USING (status = 'PUBLISHED');

-- Contact messages policies
CREATE POLICY "Anyone can create contact messages"
  ON contact_messages FOR INSERT
  TO authenticated, anon
  WITH CHECK (true);