-- 2026-04-30: anon 키로 admin CRUD 허용 (현재 store.js 설계와 일치)
-- 보안 모델:
--   * admin 진입은 /admin 페이지의 SHA-256 PW 게이트로 차단
--   * anon 키 자체는 클라이언트 JS에 노출되지만, 일반 방문자는 admin URL/PW 모름
--   * 추후 service_role로 분리 시 본 SQL 정책은 제거 권장
--
-- 적용 대상:
--   * admin_users  : anon SELECT (login 검증) + anon UPDATE (PW 변경)
--   * cms_config   : anon UPDATE (콘텐츠 편집)
--   * notices, products, qna, reviews, external_links : anon INSERT/UPDATE/DELETE (admin 편집)
--   * inquiries    : anon SELECT/UPDATE/DELETE (admin 답변/삭제) — INSERT는 000에 이미 있음

do $$
begin
  -- admin_users: anon SELECT
  if not exists (select 1 from pg_policies where schemaname='public' and tablename='admin_users' and policyname='admin_users_anon_read') then
    create policy "admin_users_anon_read" on public.admin_users for select to anon, authenticated using (true);
  end if;
  -- admin_users: anon UPDATE (PW 변경)
  if not exists (select 1 from pg_policies where schemaname='public' and tablename='admin_users' and policyname='admin_users_anon_update') then
    create policy "admin_users_anon_update" on public.admin_users for update to anon, authenticated using (true) with check (true);
  end if;

  -- cms_config: anon UPDATE
  if not exists (select 1 from pg_policies where schemaname='public' and tablename='cms_config' and policyname='cms_config_anon_update') then
    create policy "cms_config_anon_update" on public.cms_config for update to anon, authenticated using (true) with check (true);
  end if;
  -- cms_config: anon INSERT (없는 키 추가 시)
  if not exists (select 1 from pg_policies where schemaname='public' and tablename='cms_config' and policyname='cms_config_anon_insert') then
    create policy "cms_config_anon_insert" on public.cms_config for insert to anon, authenticated with check (true);
  end if;

  -- notices: anon ALL (admin 편집)
  if not exists (select 1 from pg_policies where schemaname='public' and tablename='notices' and policyname='notices_anon_insert') then
    create policy "notices_anon_insert" on public.notices for insert to anon, authenticated with check (true);
  end if;
  if not exists (select 1 from pg_policies where schemaname='public' and tablename='notices' and policyname='notices_anon_update') then
    create policy "notices_anon_update" on public.notices for update to anon, authenticated using (true) with check (true);
  end if;
  if not exists (select 1 from pg_policies where schemaname='public' and tablename='notices' and policyname='notices_anon_delete') then
    create policy "notices_anon_delete" on public.notices for delete to anon, authenticated using (true);
  end if;

  -- products: anon ALL
  if not exists (select 1 from pg_policies where schemaname='public' and tablename='products' and policyname='products_anon_insert') then
    create policy "products_anon_insert" on public.products for insert to anon, authenticated with check (true);
  end if;
  if not exists (select 1 from pg_policies where schemaname='public' and tablename='products' and policyname='products_anon_update') then
    create policy "products_anon_update" on public.products for update to anon, authenticated using (true) with check (true);
  end if;
  if not exists (select 1 from pg_policies where schemaname='public' and tablename='products' and policyname='products_anon_delete') then
    create policy "products_anon_delete" on public.products for delete to anon, authenticated using (true);
  end if;

  -- qna: anon ALL
  if not exists (select 1 from pg_policies where schemaname='public' and tablename='qna' and policyname='qna_anon_insert') then
    create policy "qna_anon_insert" on public.qna for insert to anon, authenticated with check (true);
  end if;
  if not exists (select 1 from pg_policies where schemaname='public' and tablename='qna' and policyname='qna_anon_update') then
    create policy "qna_anon_update" on public.qna for update to anon, authenticated using (true) with check (true);
  end if;
  if not exists (select 1 from pg_policies where schemaname='public' and tablename='qna' and policyname='qna_anon_delete') then
    create policy "qna_anon_delete" on public.qna for delete to anon, authenticated using (true);
  end if;

  -- reviews: anon UPDATE/DELETE (INSERT은 000에 있음)
  if not exists (select 1 from pg_policies where schemaname='public' and tablename='reviews' and policyname='reviews_anon_update') then
    create policy "reviews_anon_update" on public.reviews for update to anon, authenticated using (true) with check (true);
  end if;
  if not exists (select 1 from pg_policies where schemaname='public' and tablename='reviews' and policyname='reviews_anon_delete') then
    create policy "reviews_anon_delete" on public.reviews for delete to anon, authenticated using (true);
  end if;

  -- external_links: anon ALL
  if not exists (select 1 from pg_policies where schemaname='public' and tablename='external_links' and policyname='external_links_anon_read_all') then
    create policy "external_links_anon_read_all" on public.external_links for select to anon, authenticated using (true);
  end if;
  if not exists (select 1 from pg_policies where schemaname='public' and tablename='external_links' and policyname='external_links_anon_insert') then
    create policy "external_links_anon_insert" on public.external_links for insert to anon, authenticated with check (true);
  end if;
  if not exists (select 1 from pg_policies where schemaname='public' and tablename='external_links' and policyname='external_links_anon_update') then
    create policy "external_links_anon_update" on public.external_links for update to anon, authenticated using (true) with check (true);
  end if;
  if not exists (select 1 from pg_policies where schemaname='public' and tablename='external_links' and policyname='external_links_anon_delete') then
    create policy "external_links_anon_delete" on public.external_links for delete to anon, authenticated using (true);
  end if;

  -- inquiries: anon SELECT/UPDATE/DELETE (admin이 anon 키로 접근하므로) — INSERT는 000에 있음
  if not exists (select 1 from pg_policies where schemaname='public' and tablename='inquiries' and policyname='inquiries_anon_update') then
    create policy "inquiries_anon_update" on public.inquiries for update to anon, authenticated using (true) with check (true);
  end if;
  if not exists (select 1 from pg_policies where schemaname='public' and tablename='inquiries' and policyname='inquiries_anon_delete') then
    create policy "inquiries_anon_delete" on public.inquiries for delete to anon, authenticated using (true);
  end if;
end$$;
