Studio 7 Security Center

-- 1. Force RLS on (deny by default)
alter table leads enable row level security;
alter table leads force row level security;

-- 2. Helper to read tenant_id from Clerk JWT
create or replace function auth.tenant_id() returns uuid
language sql stable as $$
  select nullif(current_setting('request.jwt.claims', true)::json->>'tenant_id','')::uuid;
$$;

-- 3. SELECT — only your tenant's rows
create policy "tenant_read_own_leads"
on leads for select
using (tenant_id = auth.tenant_id());

-- 4. INSERT — cannot write for another tenant
create policy "tenant_insert_own_leads"
on leads for insert
with check (tenant_id = auth.tenant_id());

-- 5. UPDATE/DELETE — constrain old and new row
create policy "tenant_modify_own_leads"
on leads for update
using (tenant_id = auth.tenant_id())
with check (tenant_id = auth.tenant_id());

-- 6. Index — RLS without this crawls at scale
create index on leads (tenant_id);