-- SBUT PAY 013: repair ACCOUNT_RECORD / 42501 read privileges.
-- Run as database owner. Read-only grants; session + owner RLS stays required.
BEGIN;
GRANT USAGE ON SCHEMA public TO authenticated;
ALTER TABLE public.sbut_users ENABLE ROW LEVEL SECURITY;
ALTER TABLE public.sbut_transactions ENABLE ROW LEVEL SECURITY;
REVOKE ALL ON public.sbut_users,public.sbut_transactions FROM anon;
GRANT SELECT ON public.sbut_users,public.sbut_transactions TO authenticated;
GRANT EXECUTE ON FUNCTION public.sbut_session_active() TO authenticated;
DO $$ BEGIN
 IF to_regprocedure('public.sbut_is_admin()') IS NOT NULL THEN
  GRANT EXECUTE ON FUNCTION public.sbut_is_admin() TO authenticated;
 END IF;
END $$;
DROP POLICY IF EXISTS self_read ON public.sbut_users;
CREATE POLICY self_read ON public.sbut_users FOR SELECT TO authenticated
 USING(id=auth.uid() AND public.sbut_session_active());
DROP POLICY IF EXISTS ledger_read ON public.sbut_transactions;
CREATE POLICY ledger_read ON public.sbut_transactions FOR SELECT TO authenticated
 USING((sender=auth.uid() OR recipient=auth.uid()) AND public.sbut_session_active());
NOTIFY pgrst,'reload schema';
COMMIT;
SELECT
 has_table_privilege('authenticated','public.sbut_users','SELECT') AS account_read,
 has_table_privilege('authenticated','public.sbut_transactions','SELECT') AS ledger_read,
 has_function_privilege('authenticated','public.sbut_session_active()','EXECUTE') AS session_check,
 (SELECT relrowsecurity FROM pg_class WHERE oid='public.sbut_users'::regclass) AS account_rls;