begin;

-- Keep the same RLS semantics while evaluating auth.uid() once per statement.
alter policy sun_chat_reads_read_v29 on public.sun_chat_reads
  using ((user_id = (select auth.uid())) and public.sun_chat_can_access_thread_v29(thread_id));

-- Cover foreign keys used by chat joins/deletes.
create index if not exists sun_chat_messages_sender_user_id_idx on public.sun_chat_messages(sender_user_id);
create index if not exists sun_chat_participants_workspace_id_idx on public.sun_chat_participants(workspace_id);
create index if not exists sun_chat_reads_workspace_id_idx on public.sun_chat_reads(workspace_id);
create index if not exists sun_chat_threads_created_by_idx on public.sun_chat_threads(created_by);

-- Remove exact duplicate indexes, retaining the clearer canonical names.
drop index if exists public.sun_v17_error_workspace_created_idx;
drop index if exists public.sun_v17_orders_due_idx;

-- Server order automation is for signed-in workspace members only.
revoke execute on function public.sun_run_order_automation(uuid) from public;
revoke execute on function public.sun_run_order_automation(uuid) from anon;
grant execute on function public.sun_run_order_automation(uuid) to authenticated;
grant execute on function public.sun_run_order_automation(uuid) to service_role;

commit;