-- Create function to get current tenant from session variable
CREATE OR REPLACE FUNCTION current_tenant_id() RETURNS TEXT AS $$
  SELECT current_setting('app.current_tenant', true);
$$ LANGUAGE sql STABLE;

-- Enable RLS on User table
ALTER TABLE "User" ENABLE ROW LEVEL SECURITY;
ALTER TABLE "User" FORCE ROW LEVEL SECURITY;

CREATE POLICY tenant_isolation_policy ON "User"
  USING ("tenantId" = current_tenant_id());

-- Enable RLS on PasswordResetToken table (via userId -> User -> tenantId)
-- PasswordResetToken does not have a direct tenantId column, so we join through User
ALTER TABLE "PasswordResetToken" ENABLE ROW LEVEL SECURITY;
ALTER TABLE "PasswordResetToken" FORCE ROW LEVEL SECURITY;

CREATE POLICY tenant_isolation_policy ON "PasswordResetToken"
  USING ("userId" IN (
    SELECT "id" FROM "User" WHERE "tenantId" = current_tenant_id()
  ));

-- Enable RLS on LdapConfig table
ALTER TABLE "LdapConfig" ENABLE ROW LEVEL SECURITY;
ALTER TABLE "LdapConfig" FORCE ROW LEVEL SECURITY;

CREATE POLICY tenant_isolation_policy ON "LdapConfig"
  USING ("tenantId" = current_tenant_id());

-- Enable RLS on LdapFieldMapping table (via ldapConfigId -> LdapConfig -> tenantId)
ALTER TABLE "LdapFieldMapping" ENABLE ROW LEVEL SECURITY;
ALTER TABLE "LdapFieldMapping" FORCE ROW LEVEL SECURITY;

CREATE POLICY tenant_isolation_policy ON "LdapFieldMapping"
  USING ("ldapConfigId" IN (
    SELECT "id" FROM "LdapConfig" WHERE "tenantId" = current_tenant_id()
  ));