-- Push notification subscriptions
-- One row per user. The subscription JSONB holds the PushSubscription JSON
-- (endpoint, keys.p256dh, keys.auth) returned by the browser PushManager.
CREATE TABLE push_subscriptions (
  id           UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
  user_id      UUID        REFERENCES auth.users(id) ON DELETE CASCADE,
  subscription JSONB       NOT NULL,
  created_at   TIMESTAMPTZ DEFAULT now(),
  UNIQUE (user_id)
);

ALTER TABLE push_subscriptions ENABLE ROW LEVEL SECURITY;

-- Admins can only manage their own subscription
CREATE POLICY "Users manage own subscriptions"
  ON push_subscriptions
  USING      (auth.uid() = user_id)
  WITH CHECK (auth.uid() = user_id);