Supabase untuk Developer: Backend Instan

-- AKTIFKAN RLS pada tabel (WAJIB untuk keamanan!)
ALTER TABLE profiles ENABLE ROW LEVEL SECURITY;
ALTER TABLE posts ENABLE ROW LEVEL SECURITY;
ALTER TABLE comments ENABLE ROW LEVEL SECURITY;

-- Kebijakan untuk tabel profiles:
-- Semua orang bisa membaca profile (public)
CREATE POLICY "Public profiles are viewable by everyone"
ON profiles FOR SELECT
USING (true);

-- User hanya bisa update profile miliknya sendiri
CREATE POLICY "Users can update own profile"
ON profiles FOR UPDATE
USING (auth.uid() = id)
WITH CHECK (auth.uid() = id);

-- User baru bisa insert profile sendiri
CREATE POLICY "Users can insert own profile"
ON profiles FOR INSERT
WITH CHECK (auth.uid() = id);

-- Posts: Siapa saja bisa baca post yang published
CREATE POLICY "Published posts viewable by everyone"
ON posts FOR SELECT
USING (published = true);

-- Posts: Author bisa baca draft miliknya
CREATE POLICY "Authors can view own unpublished posts"
ON posts FOR SELECT
USING (
  auth.uid() = author_id
);

-- Posts: Authenticated user bisa buat post baru
CREATE POLICY "Authenticated users can create posts"
ON posts FOR INSERT
WITH CHECK (
  auth.uid() = author_id
  AND auth.role() = 'authenticated'
);

-- Posts: Author bisa edit post miliknya
CREATE POLICY "Authors can update own posts"
ON posts FOR UPDATE
USING (auth.uid() = author_id)
WITH CHECK (auth.uid() = author_id);

-- Posts: Author bisa hapus post miliknya
CREATE POLICY "Authors can delete own posts"
ON posts FOR DELETE
USING (auth.uid() = author_id);

-- Comments: Semua bisa baca komentar
CREATE POLICY "Comments viewable by everyone"
ON comments FOR SELECT
USING (true);

-- Comments: Authenticated user bisa komentar
CREATE POLICY "Authenticated users can create comments"
ON comments FOR INSERT
WITH CHECK (
  auth.uid() = user_id
  AND auth.role() = 'authenticated'
);

-- Comments: User bisa edit/hapus komentar sendiri
CREATE POLICY "Users can delete own comments"
ON comments FOR DELETE
USING (auth.uid() = user_id);

// Sebagai User A yang login
const { data: myPosts } = await supabase
  .from('posts')
  .select('*')
// Result: Hanya post yang published + post milik User A (termasuk draft)

// Sebagai User A — mencoba update post milik User B
const { error } = await supabase
  .from('posts')
  .update({ title: 'Diubah!' })
  .eq('id', postMilikUserB)
// Result: Tidak ada error tapi 0 rows affected (RLS memblokir)

// Sebagai anon (tidak login)
const { data: publicPosts } = await supabase
  .from('posts')
  .select('*')
// Result: Hanya post yang published = true