Your municipality,
in your pocket.

-- Every table has RLS enabled. No exceptions.
-- Citizens read their municipality only. Staff read/write their own.
-- Super admins go through a SECURITY DEFINER function.

ALTER TABLE announcements ENABLE ROW LEVEL SECURITY;
ALTER TABLE appointments  ENABLE ROW LEVEL SECURITY;
ALTER TABLE complaints     ENABLE ROW LEVEL SECURITY;
-- ... 21 more tables, all locked down

-- Citizens: read published content from their municipality only
CREATE POLICY "announcements: public read published"
  ON announcements FOR SELECT
  USING (is_published = true
    AND municipality_id = app_municipality_id());

-- Staff: verified against the staff table on every request
CREATE POLICY "announcements: staff write"
  ON announcements FOR ALL
  USING (
    EXISTS (
      SELECT 1 FROM staff s
      WHERE s.profile_id = (SELECT auth.uid())
        AND s.municipality_id = announcements.municipality_id
        AND s.is_active = true
        AND (s.role IN ('owner', 'admin')
          OR 'manage_announcements' = ANY(s.permissions))
    )
  );

-- Complaints: anyone can submit, nobody can read except staff
-- No citizen identity stored. Ever. Anonymous by design.
CREATE POLICY "complaints: anyone can submit"
  ON complaints FOR INSERT
  WITH CHECK (true);

'use server';

import { assertAuth } from '@/lib/auth-guard';
import { createAdminClient } from '@/lib/supabase/admin';

// Every server action:
// 1. Verifies the JWT against Supabase (not just cookies)
// 2. Fetches the staff record fresh from the DB
// 3. Checks the specific permission required
// 4. Uses the server-verified municipalityId — never a client value

export async function createAnnouncement(
  _clientMunicipalityId: string, // intentionally ignored
  data: AnnouncementFormData
) {
  const guard = await assertAuth('manage_announcements');
  if ('error' in guard) return guard; // 403 if not staff
  const { municipalityId } = guard; // from DB, not client

  const supabase = createAdminClient();
  const { error } = await supabase
    .from('announcements')
    .insert({ ...data, municipality_id: municipalityId });

  if (error) return { error: error.message };
  revalidatePath('/dashboard/announcements');
  return {};
}

// 4 parallel queries fire simultaneously with Promise.all().
// Skeleton screens show immediately while data loads.
// Error state distinguishes offline from server error.

export function useHomeData(): UseHomeDataReturn {
  const load = useCallback(async (isRefresh = false) => {
    const [ann, nws, evt, hrs] = await Promise.all([
      supabase.from('announcements')
        .select('id, title_en, title_ar, image_url, is_pinned, published_at')
        .eq('municipality_id', mId)
        .eq('is_published', true)
        .order('is_pinned', { ascending: false })
        .limit(5),
      // ... news, events, opening_hours in parallel
    ]);

    setData({
      announcements: (ann.data as Announcement[]) ?? [],
      news:          (nws.data as News[]) ?? [],
      events:        (evt.data as Event[]) ?? [],
      openingHours:  (hrs.data as OpeningHour[]) ?? [],
    });
  }, [municipality?.id]);

  return { data, loading, refreshing, error,
    refetch: () => load(true) };
}