Custom CRMs, forged for your business.

-- Helper: is the current user a member of the given workspace?
create or replace function is_workspace_member(ws uuid)
returns boolean language sql stable security definer
as $$
  select exists (
    select 1 from workspace_members m
    where m.workspace_id = ws and m.user_id = auth.uid()
  );
$$;

-- Generic workspace-scoped policies for domain tables.
foreach t in array array[
  'companies','contacts','pipeline_stages','leads','activities','tasks',
  'email_templates','email_messages','meetings','content_items'
]
loop
  execute format(
    'create policy %1$s_rw on %1$s for all
       using (is_workspace_member(workspace_id))
       with check (is_workspace_member(workspace_id));', t);

/**
 * Pluggable email integration. The SimulatedEmailProvider is used in demo
 * mode; a GmailEmailProvider / MicrosoftEmailProvider can implement the same
 * interface later without any UI changes.
 */
export interface EmailProvider {
  readonly id: string;
  send(db: SupabaseClient, input: SendEmailInput): Promise<EmailMessage>;
  /**
   * Poll a provider thread for an inbound reply newer than `afterISO`.
   * Read-only: reply detection must never send anything.
   */
  threadHasReply?(workspaceId: string, threadId: string, afterISO: string): Promise<boolean>;
  listTemplates(db: SupabaseClient, workspaceId: string): Promise<EmailTemplate[]>;
  getStats(db: SupabaseClient, workspaceId: string): Promise<EmailStats>;
}

export function canSendCampaign(campaign: CampaignGateInput): GateResult {
  if (!campaign.approved_by) {
    return { ok: false, reason: "Campaign has not been approved by a human." };
  }
  if (campaign.status !== "approved" && campaign.status !== "sending") {
    return { ok: false, reason: `Campaign status is "${campaign.status}", not approved.` };
  }
  return { ok: true };
}