13 lines
613 B
SQL
13 lines
613 B
SQL
-- Fix: notifications_log RLS was allowing any hse/admin to read ALL notifications.
|
|
-- Replace with per-user policy (everyone reads own) + admin-only policy for oversight.
|
|
|
|
DROP POLICY IF EXISTS "notifications_read_elevated" ON notifications_log;
|
|
DROP POLICY IF EXISTS "notifications_read_own" ON notifications_log;
|
|
DROP POLICY IF EXISTS "notifications_read_admin" ON notifications_log;
|
|
|
|
CREATE POLICY "notifications_read_own" ON notifications_log
|
|
FOR SELECT USING (recipient_user_id = auth.uid());
|
|
|
|
CREATE POLICY "notifications_read_admin" ON notifications_log
|
|
FOR SELECT USING (auth_user_role() = 'admin');
|