-- Tabla users: extiende auth.users con atributos de la plataforma
CREATE TABLE IF NOT EXISTS public.users (
  id            uuid PRIMARY KEY REFERENCES auth.users(id) ON DELETE CASCADE,
  name          text,
  avatar_url    text,
  platform_role text NOT NULL DEFAULT 'guest'
                CHECK (platform_role IN ('platform_admin', 'member', 'guest')),
  created_at    timestamptz NOT NULL DEFAULT now()
);

-- RLS
ALTER TABLE public.users ENABLE ROW LEVEL SECURITY;

CREATE POLICY "read_users" ON public.users
  FOR SELECT USING (auth.uid() IS NOT NULL);

CREATE POLICY "update_own_user" ON public.users
  FOR UPDATE USING (id = auth.uid());

CREATE POLICY "insert_users" ON public.users
  FOR INSERT WITH CHECK (id = auth.uid());