-- Realtime evaluates these same SELECT policies for every INSERT/UPDATE event.
-- Players may read their own appeal history; only active staff may read others.
grant select on public.account_appeals to authenticated;
create policy "Players and active staff read account appeals"
on public.account_appeals for select to authenticated using (
 owner_id=(select auth.uid()) or exists (
  select 1 from public.profiles p
  where p.id=(select auth.uid()) and p.role in ('moderator','admin') and p.account_status='active'
 )
);

-- Standalone SQL test databases do not configure the hosted Realtime publication.
do $$ begin
 if exists(select 1 from pg_publication where pubname='supabase_realtime') then
  if not exists(select 1 from pg_publication_tables where pubname='supabase_realtime' and schemaname='public' and tablename='account_appeals') then
   alter publication supabase_realtime add table public.account_appeals;
  end if;
  -- The existing own_profile policy restricts status changes to the owner.
  if not exists(select 1 from pg_publication_tables where pubname='supabase_realtime' and schemaname='public' and tablename='profiles') then
   alter publication supabase_realtime add table public.profiles;
  end if;
 end if;
end $$;