--liquibase formatted sql
-- PANELS · panels_product.core (Postgres) · Row Level Security (Fase 4b)
--
-- Mismo mecanismo que iam (ver db/iam/changesets/002-rls.sql): el rol de
-- runtime (panels_core_app) no es dueño de las tablas, así que
-- ENABLE ROW LEVEL SECURITY ya lo restringe sin afectar a panels_core_owner
-- (que sí necesita ver todos los tenants para migrar/hacer backfills).
--
-- Alcance: se aplica a las tablas con columna tenant_id directa --
-- companies, workers, projects, payroll_weeks, destajo_units/periods/jobs.
-- Tablas hijas sin tenant_id propio (assignments, documents, budget_items,
-- loans, attendance, badge_jobs, payroll_week_lines, etc.) dependen del
-- scoping corregido en la capa de aplicación (Fase 3, cierre del IDOR) via
-- su FK a projects/workers -- extender RLS a esas tablas con políticas por
-- subquery es un endurecimiento futuro válido, no bloqueante para esta fase.

--changeset panel:core-005a-rls-companies endDelimiter:; splitStatements:true
--preconditions onFail:MARK_RAN
--precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM pg_policies WHERE schemaname='core' AND tablename='companies' AND policyname='tenant_isolation'
ALTER TABLE core.companies ENABLE ROW LEVEL SECURITY;
CREATE POLICY tenant_isolation ON core.companies
  USING (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer)
  WITH CHECK (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer);

--changeset panel:core-005b-rls-workers endDelimiter:; splitStatements:true
--preconditions onFail:MARK_RAN
--precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM pg_policies WHERE schemaname='core' AND tablename='workers' AND policyname='tenant_isolation'
ALTER TABLE core.workers ENABLE ROW LEVEL SECURITY;
CREATE POLICY tenant_isolation ON core.workers
  USING (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer)
  WITH CHECK (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer);

--changeset panel:core-005c-rls-projects endDelimiter:; splitStatements:true
--preconditions onFail:MARK_RAN
--precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM pg_policies WHERE schemaname='core' AND tablename='projects' AND policyname='tenant_isolation'
ALTER TABLE core.projects ENABLE ROW LEVEL SECURITY;
CREATE POLICY tenant_isolation ON core.projects
  USING (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer)
  WITH CHECK (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer);

--changeset panel:core-005d-rls-payroll-weeks endDelimiter:; splitStatements:true
--preconditions onFail:MARK_RAN
--precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM pg_policies WHERE schemaname='core' AND tablename='payroll_weeks' AND policyname='tenant_isolation'
ALTER TABLE core.payroll_weeks ENABLE ROW LEVEL SECURITY;
CREATE POLICY tenant_isolation ON core.payroll_weeks
  USING (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer)
  WITH CHECK (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer);

--changeset panel:core-005e-rls-destajo-units endDelimiter:; splitStatements:true
--preconditions onFail:MARK_RAN
--precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM pg_policies WHERE schemaname='core' AND tablename='destajo_units' AND policyname='tenant_isolation'
ALTER TABLE core.destajo_units ENABLE ROW LEVEL SECURITY;
CREATE POLICY tenant_isolation ON core.destajo_units
  USING (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer)
  WITH CHECK (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer);

--changeset panel:core-005f-rls-destajo-periods endDelimiter:; splitStatements:true
--preconditions onFail:MARK_RAN
--precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM pg_policies WHERE schemaname='core' AND tablename='destajo_periods' AND policyname='tenant_isolation'
ALTER TABLE core.destajo_periods ENABLE ROW LEVEL SECURITY;
CREATE POLICY tenant_isolation ON core.destajo_periods
  USING (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer)
  WITH CHECK (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer);

--changeset panel:core-005g-rls-destajo-jobs endDelimiter:; splitStatements:true
--preconditions onFail:MARK_RAN
--precondition-sql-check expectedResult:0 SELECT COUNT(*) FROM pg_policies WHERE schemaname='core' AND tablename='destajo_jobs' AND policyname='tenant_isolation'
ALTER TABLE core.destajo_jobs ENABLE ROW LEVEL SECURITY;
CREATE POLICY tenant_isolation ON core.destajo_jobs
  USING (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer)
  WITH CHECK (tenant_id = NULLIF(current_setting('app.tenant_id', true), '')::integer);