From 17f67f057722afefaa37f0fb35ff47a4480bf7c6 Mon Sep 17 00:00:00 2001
From: "gpt-engineer-app[bot]"
 <159125892+gpt-engineer-app[bot]@users.noreply.github.com>
Date: Sat, 11 Jul 2026 13:53:01 +0000
Subject: [PATCH] Changes

Co-authored-by: wolfoftyreso-debug <250630591+wolfoftyreso-debug@users.noreply.github.com>
---
 ...9_21be1d79-4fce-4a98-8883-62dd781c72d7.sql | 27 +++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 supabase/migrations/20260711135259_21be1d79-4fce-4a98-8883-62dd781c72d7.sql

diff --git a/supabase/migrations/20260711135259_21be1d79-4fce-4a98-8883-62dd781c72d7.sql b/supabase/migrations/20260711135259_21be1d79-4fce-4a98-8883-62dd781c72d7.sql
new file mode 100644
index 0000000..3373370
--- /dev/null
+++ b/supabase/migrations/20260711135259_21be1d79-4fce-4a98-8883-62dd781c72d7.sql
@@ -0,0 +1,27 @@
+
+-- Orders: admin-only reads
+DROP POLICY IF EXISTS "Authenticated users can view all orders" ON public.orders;
+CREATE POLICY "Admins can view orders"
+  ON public.orders FOR SELECT
+  TO authenticated
+  USING (public.has_role(auth.uid(), 'admin'));
+
+-- Customers: admin-only
+DROP POLICY IF EXISTS "Authenticated users can manage customers" ON public.customers;
+DROP POLICY IF EXISTS "Authenticated users can view customers" ON public.customers;
+CREATE POLICY "Admins can view customers"
+  ON public.customers FOR SELECT
+  TO authenticated
+  USING (public.has_role(auth.uid(), 'admin'));
+CREATE POLICY "Admins can manage customers"
+  ON public.customers FOR ALL
+  TO authenticated
+  USING (public.has_role(auth.uid(), 'admin'))
+  WITH CHECK (public.has_role(auth.uid(), 'admin'));
+
+-- Payments: admin-only reads
+DROP POLICY IF EXISTS "Authenticated users can view payments" ON public.payments;
+CREATE POLICY "Admins can view payments"
+  ON public.payments FOR SELECT
+  TO authenticated
+  USING (public.has_role(auth.uid(), 'admin'));