-- Recruiter-safe sample from Synapse, an independently owned project.
-- This is the real workspace-membership helper and row-level security policy pattern.

create or replace function public.is_workspace_member(target_workspace_id uuid)
returns boolean
language sql
stable
security definer
set search_path = public
as $$
  select exists (
    select 1
    from public.workspace_users
    where workspace_id = target_workspace_id
      and user_id = auth.uid()
  );
$$;

alter table public.upload_packages enable row level security;
alter table public.processing_jobs enable row level security;
alter table public.media_items enable row level security;
alter table public.transcript_chunks enable row level security;
alter table public.citations enable row level security;
alter table public.search_index_records enable row level security;

create policy "workspace members can read uploads"
on public.upload_packages
for select
to authenticated
using (public.is_workspace_member(workspace_id));

create policy "workspace members can read processing jobs"
on public.processing_jobs
for select
to authenticated
using (public.is_workspace_member(workspace_id));

create policy "workspace members can read media"
on public.media_items
for select
to authenticated
using (public.is_workspace_member(workspace_id));

create policy "workspace members can read transcripts"
on public.transcript_chunks
for select
to authenticated
using (public.is_workspace_member(workspace_id));

create policy "workspace members can read citations"
on public.citations
for select
to authenticated
using (public.is_workspace_member(workspace_id));

create policy "workspace members can read search records"
on public.search_index_records
for select
to authenticated
using (public.is_workspace_member(workspace_id));