-- Explicit restrictive deny policies to block client-side writes on sensitive tables.
-- Service role bypasses RLS, so server-side admin code still works.

-- subscriptions: only server (service_role) may write
CREATE POLICY "Deny client inserts on subscriptions"
  ON public.subscriptions AS RESTRICTIVE FOR INSERT TO authenticated, anon
  WITH CHECK (false);

CREATE POLICY "Deny client updates on subscriptions"
  ON public.subscriptions AS RESTRICTIVE FOR UPDATE TO authenticated, anon
  USING (false) WITH CHECK (false);

CREATE POLICY "Deny client deletes on subscriptions"
  ON public.subscriptions AS RESTRICTIVE FOR DELETE TO authenticated, anon
  USING (false);

-- user_roles: writes only via SECURITY DEFINER functions (e.g. claim_first_admin) or service_role
CREATE POLICY "Deny client inserts on user_roles"
  ON public.user_roles AS RESTRICTIVE FOR INSERT TO authenticated, anon
  WITH CHECK (false);

CREATE POLICY "Deny client updates on user_roles"
  ON public.user_roles AS RESTRICTIVE FOR UPDATE TO authenticated, anon
  USING (false) WITH CHECK (false);

CREATE POLICY "Deny client deletes on user_roles"
  ON public.user_roles AS RESTRICTIVE FOR DELETE TO authenticated, anon
  USING (false);