-- ============================================================================
-- FFH Biometrics — Omron + Kardia additions   (2026-06-03)
-- ============================================================================
-- The existing public.biometric_logs and public.coin_events tables already
-- handle the new device types with NO schema change:
--   • Omron  → reading_type='blood_pressure', values={systolic,diastolic,pulse}
--   • Kardia → reading_type='ecg',            values={heart_rate,determination,photo}
--
-- The ONLY new optional object is a Storage bucket for the Kardia result photo.
-- Run this in the Supabase SQL editor when you want photo uploads to persist.
-- Until it exists, the Kardia page still works (photo shows locally; the log
-- records `photo:"attached (sign in to save)"`).
-- ----------------------------------------------------------------------------

-- 1) Private bucket for member-uploaded biometric images (Kardia result shots)
insert into storage.buckets (id, name, public)
values ('biometric-uploads', 'biometric-uploads', false)
on conflict (id) do nothing;

-- 2) RLS: a member may upload/read only files under their own user-id prefix
--    Path convention used by the page:  {user_id}/kardia/{timestamp}.jpg
create policy "biometric uploads — own folder insert"
on storage.objects for insert to authenticated
with check (
  bucket_id = 'biometric-uploads'
  and (storage.foldername(name))[1] = auth.uid()::text
);

create policy "biometric uploads — own folder read"
on storage.objects for select to authenticated
using (
  bucket_id = 'biometric-uploads'
  and (storage.foldername(name))[1] = auth.uid()::text
);

-- ----------------------------------------------------------------------------
-- NOTE: OMRON Connect cloud sync and the AliveCor Kardia SDK each require a
-- signed developer agreement and serverless proxy routes (/api/omron/*,
-- /api/kardia/*) that hold the client secrets. Those are documented in
-- omron-connect-bridge.js and kardia-sdk-bridge.js. No DB change is needed for
-- them — they write through the same biometric_logs/coin_events path above.
-- ============================================================================
