-- ============================================================
-- Gustito Express — Buckets de Storage
--   menu:         fotos de productos/logos (lectura publica)
--   comprobantes: capturas de Pago Movil (privado; sube el comensal, leen staff/admin)
-- Las policies se crean de forma defensiva: si el rol no tiene DDL sobre storage.objects
-- (caso de Supabase hosted), no rompe el `db reset`; se crean luego.
-- ============================================================
insert into storage.buckets (id, name, public)
values ('menu', 'menu', true),
       ('comprobantes', 'comprobantes', false)
on conflict (id) do nothing;

do $$
begin
  create policy "menu_lectura_publica" on storage.objects
    for select to anon, authenticated using (bucket_id = 'menu');
  create policy "menu_escritura_auth" on storage.objects
    for insert to authenticated with check (bucket_id = 'menu');
  create policy "menu_update_auth" on storage.objects
    for update to authenticated using (bucket_id = 'menu');
  create policy "menu_delete_auth" on storage.objects
    for delete to authenticated using (bucket_id = 'menu');
  create policy "comprobantes_subir" on storage.objects
    for insert to anon, authenticated with check (bucket_id = 'comprobantes');
  create policy "comprobantes_leer_auth" on storage.objects
    for select to authenticated using (bucket_id = 'comprobantes');
exception
  when insufficient_privilege then
    raise notice 'Sin privilegio DDL sobre storage.objects; policies de storage omitidas.';
  when duplicate_object then
    raise notice 'Policies de storage ya existen; se omiten.';
end $$;