CRM_ENVR/Web_Calendar/database/015_rls_calendar_participant.sql

-- ============================================================================
-- Migration 015: Fix RLS for scheduled_events to include participant_id
-- ============================================================================
-- Previously, the RLS policy only checked user_id, which meant participants
-- could not see events at the database level (the app-layer WHERE clause
-- did the filtering, but RLS was defense-in-depth that missed this case).
--
-- This policy also allows app.current_user_id IS NULL for backward compat
-- with queries that don't set the session variable.
-- ============================================================================

DROP POLICY IF EXISTS scheduled_events_user_policy ON scheduled_events;
CREATE POLICY scheduled_events_user_policy ON scheduled_events
  FOR ALL
  USING (
    user_id = current_setting('app.current_user_id', true)::uuid
    OR participant_id = current_setting('app.current_user_id', true)::uuid
    OR current_setting('app.current_user_id', true) IS NULL
  );