-- Fix: notifications_log RLS was allowing any hse/admin to read ALL notifications.
-- Replace with per-user policy (everyone reads own) + admin-only policy for oversight.

DROP POLICY IF EXISTS "notifications_read_elevated" ON notifications_log;
DROP POLICY IF EXISTS "notifications_read_own" ON notifications_log;
DROP POLICY IF EXISTS "notifications_read_admin" ON notifications_log;

CREATE POLICY "notifications_read_own" ON notifications_log
  FOR SELECT USING (recipient_user_id = auth.uid());

CREATE POLICY "notifications_read_admin" ON notifications_log
  FOR SELECT USING (auth_user_role() = 'admin');