insforge 1.2.10 → 1.3.0

package/backend/src/api/routes/realtime/permissions.routes.ts

@@ -0,0 +1,19 @@
+import { Router, Response, NextFunction } from 'express';
+import { verifyAdmin, AuthRequest } from '@/api/middlewares/auth.js';
+import { RealtimeChannelService } from '@/services/realtime/realtime-channel.service.js';
+import { successResponse } from '@/utils/response.js';
+
+const router = Router();
+const channelService = RealtimeChannelService.getInstance();
+
+// Get realtime RLS permissions (subscribe on channels, publish on messages)
+router.get('/', verifyAdmin, async (_req: AuthRequest, res: Response, next: NextFunction) => {
+  try {
+    const permissions = await channelService.getPermissions();
+    successResponse(res, permissions);
+  } catch (error) {
+    next(error);
+  }
+});
+
+export { router as permissionsRouter };

package/backend/src/api/routes/storage/index.routes.ts

@@ -79,9 +79,12 @@ router.post(
       });
 
       const socket = SocketManager.getInstance();
-      socket.broadcastToRoom('role:project_admin', ServerEvents.DATA_UPDATE, {
-        resource: DataUpdateResourceType.BUCKETS,
-      });
+      socket.broadcastToRoom(
+        'role:project_admin',
+        ServerEvents.DATA_UPDATE,
+        { resource: DataUpdateResourceType.BUCKETS },
+        'system'
+      );
 
       const accessInfo = isPublic
         ? 'This is a PUBLIC bucket - objects can be accessed without authentication.'
@@ -150,12 +153,12 @@ router.patch(
       });
 
       const socket = SocketManager.getInstance();
-      socket.broadcastToRoom('role:project_admin', ServerEvents.DATA_UPDATE, {
-        resource: DataUpdateResourceType.BUCKETS,
-        data: {
-          bucketName,
-        },
-      });
+      socket.broadcastToRoom(
+        'role:project_admin',
+        ServerEvents.DATA_UPDATE,
+        { resource: DataUpdateResourceType.BUCKETS, data: { bucketName } },
+        'system'
+      );
 
       const accessInfo = isPublic
         ? 'Bucket is now PUBLIC - objects can be accessed without authentication.'
@@ -379,9 +382,12 @@ router.delete(
       });
 
       const socket = SocketManager.getInstance();
-      socket.broadcastToRoom('role:project_admin', ServerEvents.DATA_UPDATE, {
-        resource: DataUpdateResourceType.BUCKETS,
-      });
+      socket.broadcastToRoom(
+        'role:project_admin',
+        ServerEvents.DATA_UPDATE,
+        { resource: DataUpdateResourceType.BUCKETS },
+        'system'
+      );
 
       successResponse(
         res,

package/backend/src/api/routes/usage/index.routes.ts

@@ -33,10 +33,12 @@ usageRouter.post(
       // Broadcast MCP tool usage to frontend via socket
       const socketService = SocketManager.getInstance();
 
-      socketService.broadcastToRoom('role:project_admin', ServerEvents.MCP_CONNECTED, {
-        tool_name,
-        created_at: result.created_at,
-      });
+      socketService.broadcastToRoom(
+        'role:project_admin',
+        ServerEvents.MCP_CONNECTED,
+        { tool_name, created_at: result.created_at },
+        'system'
+      );
 
       successResponse(res, { success: true });
     } catch (error) {

package/backend/src/infra/database/database.manager.ts

@@ -1,4 +1,4 @@
-import { Pool } from 'pg';
+import { Pool, Client } from 'pg';
 import path from 'path';
 import fs from 'fs/promises';
 import { fileURLToPath } from 'url';
@@ -163,6 +163,19 @@ export class DatabaseManager {
     return this.pool;
   }
 
+  /**
+   * Create a dedicated client for operations that can't use pooled connections (e.g., LISTEN/NOTIFY)
+   */
+  createClient(): Client {
+    return new Client({
+      host: process.env.POSTGRES_HOST || 'localhost',
+      port: parseInt(process.env.POSTGRES_PORT || '5432'),
+      database: process.env.POSTGRES_DB || 'insforge',
+      user: process.env.POSTGRES_USER || 'postgres',
+      password: process.env.POSTGRES_PASSWORD || 'postgres',
+    });
+  }
+
   async close(): Promise<void> {
     await this.pool.end();
   }

package/backend/src/infra/database/migrations/000_create-base-tables.sql

@@ -1,142 +1,142 @@
--- Migration: 000 - Create base system tables
--- This migration creates all the initial tables that the application needs
-
--- System configuration
-CREATE TABLE IF NOT EXISTS _config (
-  key TEXT PRIMARY KEY,
-  value TEXT NOT NULL,
-  created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP,
-  updated_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP
-);
-
--- App metadata
-CREATE TABLE IF NOT EXISTS _metadata (
-  key TEXT PRIMARY KEY,
-  value TEXT,
-  created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP,
-  updated_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP
-);
-
--- Storage buckets table to track bucket-level settings
-CREATE TABLE IF NOT EXISTS _storage_buckets (
-  name TEXT PRIMARY KEY,
-  public BOOLEAN DEFAULT TRUE,
-  created_at TIMESTAMPTZ DEFAULT NOW(),
-  updated_at TIMESTAMPTZ DEFAULT NOW()
-);
-
--- Storage files table
-CREATE TABLE IF NOT EXISTS _storage (
-  bucket TEXT NOT NULL,
-  key TEXT NOT NULL,
-  size INTEGER NOT NULL,
-  mime_type TEXT,
-  uploaded_at TIMESTAMPTZ DEFAULT NOW(),
-  PRIMARY KEY (bucket, key),
-  FOREIGN KEY (bucket) REFERENCES _storage_buckets(name) ON DELETE CASCADE
-);
-
--- MCP usage tracking table
-CREATE TABLE IF NOT EXISTS _mcp_usage (
-  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-  tool_name VARCHAR(255) NOT NULL,
-  success BOOLEAN DEFAULT true,
-  created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP
-);
-
--- AI configurations table
-CREATE TABLE IF NOT EXISTS _ai_configs (
-  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
-  modality VARCHAR(255) NOT NULL,
-  provider VARCHAR(255) NOT NULL,
-  model_id VARCHAR(255) UNIQUE NOT NULL,
-  system_prompt TEXT,
-  created_at TIMESTAMPTZ DEFAULT NOW(),
-  updated_at TIMESTAMPTZ DEFAULT NOW()
-);
-
-CREATE TABLE IF NOT EXISTS _ai_usage (
-  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
-  config_id UUID NOT NULL,
-  input_tokens INT,
-  output_tokens INT,
-  image_count INT,
-  image_resolution TEXT,
-  created_at TIMESTAMPTZ DEFAULT NOW(),
-  FOREIGN KEY (config_id) REFERENCES _ai_configs(id) ON DELETE NO ACTION
-);
-
--- Indexes for AI tables
-CREATE INDEX IF NOT EXISTS idx_ai_usage_config_id ON _ai_usage(config_id);
-CREATE INDEX IF NOT EXISTS idx_ai_usage_created_at ON _ai_usage(created_at DESC);
-
--- Index for efficient date range queries
-CREATE INDEX IF NOT EXISTS idx_mcp_usage_created_at ON _mcp_usage(created_at DESC);
-
--- Edge functions
-CREATE TABLE IF NOT EXISTS _edge_functions (
-  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
-  slug VARCHAR(255) UNIQUE NOT NULL,
-  name VARCHAR(255) NOT NULL,
-  description TEXT,
-  code TEXT NOT NULL,
-  status VARCHAR(50) DEFAULT 'draft',
-  created_at TIMESTAMPTZ DEFAULT NOW(),
-  updated_at TIMESTAMPTZ DEFAULT NOW(),
-  deployed_at TIMESTAMPTZ
-);
-
--- Auth Tables (2-table structure)
--- User table
-CREATE TABLE IF NOT EXISTS _user (
-  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-  email TEXT UNIQUE NOT NULL,
-  password TEXT, -- NULL for OAuth-only users
-  name TEXT,
-  email_verified BOOLEAN DEFAULT false,
-  created_at TIMESTAMPTZ DEFAULT NOW(),
-  updated_at TIMESTAMPTZ DEFAULT NOW()
-);
-
--- Account table (for OAuth connections)
-CREATE TABLE IF NOT EXISTS _account (
-  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-  user_id UUID NOT NULL REFERENCES _user(id) ON DELETE CASCADE,
-  provider TEXT NOT NULL, -- OAuth provider name: 'google', 'github', etc.
-  provider_account_id TEXT NOT NULL, -- User's unique ID on the provider's system
-  access_token TEXT, -- OAuth access token for making API calls to provider
-  refresh_token TEXT, -- OAuth refresh token for renewing access
-  provider_data JSONB, -- OAuth provider's user profile
-  created_at TIMESTAMPTZ DEFAULT NOW(),
-  updated_at TIMESTAMPTZ DEFAULT NOW(),
-  UNIQUE(provider, provider_account_id)
-);
-
--- Create update timestamp function
-CREATE OR REPLACE FUNCTION update_updated_at_column()
-RETURNS TRIGGER AS $$
-BEGIN
-  NEW.updated_at = NOW();
-  RETURN NEW;
-END;
-$$ language 'plpgsql';
-
--- Create triggers for updated_at
-DROP TRIGGER IF EXISTS update__config_updated_at ON _config;
-CREATE TRIGGER update__config_updated_at BEFORE UPDATE ON _config
-FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();
-
-DROP TRIGGER IF EXISTS update__metadata_updated_at ON _metadata;
-CREATE TRIGGER update__metadata_updated_at BEFORE UPDATE ON _metadata
-FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();
-
-DROP TRIGGER IF EXISTS update__edge_functions_updated_at ON _edge_functions;
-CREATE TRIGGER update__edge_functions_updated_at BEFORE UPDATE ON _edge_functions
-FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();
-
--- Insert initial metadata
-INSERT INTO _metadata (key, value) VALUES ('version', '1.0.0')
-ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
-
-INSERT INTO _metadata (key, value) VALUES ('created_at', NOW()::TEXT)
+-- Migration: 000 - Create base system tables
+-- This migration creates all the initial tables that the application needs
+
+-- System configuration
+CREATE TABLE IF NOT EXISTS _config (
+  key TEXT PRIMARY KEY,
+  value TEXT NOT NULL,
+  created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP,
+  updated_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP
+);
+
+-- App metadata
+CREATE TABLE IF NOT EXISTS _metadata (
+  key TEXT PRIMARY KEY,
+  value TEXT,
+  created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP,
+  updated_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP
+);
+
+-- Storage buckets table to track bucket-level settings
+CREATE TABLE IF NOT EXISTS _storage_buckets (
+  name TEXT PRIMARY KEY,
+  public BOOLEAN DEFAULT TRUE,
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  updated_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- Storage files table
+CREATE TABLE IF NOT EXISTS _storage (
+  bucket TEXT NOT NULL,
+  key TEXT NOT NULL,
+  size INTEGER NOT NULL,
+  mime_type TEXT,
+  uploaded_at TIMESTAMPTZ DEFAULT NOW(),
+  PRIMARY KEY (bucket, key),
+  FOREIGN KEY (bucket) REFERENCES _storage_buckets(name) ON DELETE CASCADE
+);
+
+-- MCP usage tracking table
+CREATE TABLE IF NOT EXISTS _mcp_usage (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tool_name VARCHAR(255) NOT NULL,
+  success BOOLEAN DEFAULT true,
+  created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP
+);
+
+-- AI configurations table
+CREATE TABLE IF NOT EXISTS _ai_configs (
+  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
+  modality VARCHAR(255) NOT NULL,
+  provider VARCHAR(255) NOT NULL,
+  model_id VARCHAR(255) UNIQUE NOT NULL,
+  system_prompt TEXT,
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  updated_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+CREATE TABLE IF NOT EXISTS _ai_usage (
+  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
+  config_id UUID NOT NULL,
+  input_tokens INT,
+  output_tokens INT,
+  image_count INT,
+  image_resolution TEXT,
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  FOREIGN KEY (config_id) REFERENCES _ai_configs(id) ON DELETE NO ACTION
+);
+
+-- Indexes for AI tables
+CREATE INDEX IF NOT EXISTS idx_ai_usage_config_id ON _ai_usage(config_id);
+CREATE INDEX IF NOT EXISTS idx_ai_usage_created_at ON _ai_usage(created_at DESC);
+
+-- Index for efficient date range queries
+CREATE INDEX IF NOT EXISTS idx_mcp_usage_created_at ON _mcp_usage(created_at DESC);
+
+-- Edge functions
+CREATE TABLE IF NOT EXISTS _edge_functions (
+  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
+  slug VARCHAR(255) UNIQUE NOT NULL,
+  name VARCHAR(255) NOT NULL,
+  description TEXT,
+  code TEXT NOT NULL,
+  status VARCHAR(50) DEFAULT 'draft',
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  updated_at TIMESTAMPTZ DEFAULT NOW(),
+  deployed_at TIMESTAMPTZ
+);
+
+-- Auth Tables (2-table structure)
+-- User table
+CREATE TABLE IF NOT EXISTS _user (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  email TEXT UNIQUE NOT NULL,
+  password TEXT, -- NULL for OAuth-only users
+  name TEXT,
+  email_verified BOOLEAN DEFAULT false,
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  updated_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- Account table (for OAuth connections)
+CREATE TABLE IF NOT EXISTS _account (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id UUID NOT NULL REFERENCES _user(id) ON DELETE CASCADE,
+  provider TEXT NOT NULL, -- OAuth provider name: 'google', 'github', etc.
+  provider_account_id TEXT NOT NULL, -- User's unique ID on the provider's system
+  access_token TEXT, -- OAuth access token for making API calls to provider
+  refresh_token TEXT, -- OAuth refresh token for renewing access
+  provider_data JSONB, -- OAuth provider's user profile
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  updated_at TIMESTAMPTZ DEFAULT NOW(),
+  UNIQUE(provider, provider_account_id)
+);
+
+-- Create update timestamp function
+CREATE OR REPLACE FUNCTION update_updated_at_column()
+RETURNS TRIGGER AS $$
+BEGIN
+  NEW.updated_at = NOW();
+  RETURN NEW;
+END;
+$$ language 'plpgsql';
+
+-- Create triggers for updated_at
+DROP TRIGGER IF EXISTS update__config_updated_at ON _config;
+CREATE TRIGGER update__config_updated_at BEFORE UPDATE ON _config
+FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();
+
+DROP TRIGGER IF EXISTS update__metadata_updated_at ON _metadata;
+CREATE TRIGGER update__metadata_updated_at BEFORE UPDATE ON _metadata
+FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();
+
+DROP TRIGGER IF EXISTS update__edge_functions_updated_at ON _edge_functions;
+CREATE TRIGGER update__edge_functions_updated_at BEFORE UPDATE ON _edge_functions
+FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();
+
+-- Insert initial metadata
+INSERT INTO _metadata (key, value) VALUES ('version', '1.0.0')
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO _metadata (key, value) VALUES ('created_at', NOW()::TEXT)
 ON CONFLICT (key) DO NOTHING;

package/backend/src/infra/database/migrations/001_create-helper-functions.sql

@@ -1,41 +1,41 @@
--- Migration: 001 - Create helper functions for RLS
--- These functions extract user information from JWT claims
-
--- Function to get current user ID from JWT
-CREATE OR REPLACE FUNCTION public.uid()
-RETURNS uuid
-LANGUAGE sql STABLE
-AS $$
-  SELECT
-  nullif(
-    coalesce(
-      current_setting('request.jwt.claim.sub', true),
-      (current_setting('request.jwt.claims', true)::jsonb ->> 'sub')
-    ),
-    ''
-  )::uuid
-$$;
-
--- Function to get current user role from JWT
-CREATE OR REPLACE FUNCTION public.role()
-RETURNS text
-LANGUAGE sql STABLE
-AS $$
-  SELECT
-  coalesce(
-    current_setting('request.jwt.claim.role', true),
-    (current_setting('request.jwt.claims', true)::jsonb ->> 'role')
-  )::text
-$$;
-
--- Function to get current user email from JWT
-CREATE OR REPLACE FUNCTION public.email()
-RETURNS text
-LANGUAGE sql STABLE
-AS $$
-  SELECT
-  coalesce(
-    current_setting('request.jwt.claim.email', true),
-    (current_setting('request.jwt.claims', true)::jsonb ->> 'email')
-  )::text
+-- Migration: 001 - Create helper functions for RLS
+-- These functions extract user information from JWT claims
+
+-- Function to get current user ID from JWT
+CREATE OR REPLACE FUNCTION public.uid()
+RETURNS uuid
+LANGUAGE sql STABLE
+AS $$
+  SELECT
+  nullif(
+    coalesce(
+      current_setting('request.jwt.claim.sub', true),
+      (current_setting('request.jwt.claims', true)::jsonb ->> 'sub')
+    ),
+    ''
+  )::uuid
+$$;
+
+-- Function to get current user role from JWT
+CREATE OR REPLACE FUNCTION public.role()
+RETURNS text
+LANGUAGE sql STABLE
+AS $$
+  SELECT
+  coalesce(
+    current_setting('request.jwt.claim.role', true),
+    (current_setting('request.jwt.claims', true)::jsonb ->> 'role')
+  )::text
+$$;
+
+-- Function to get current user email from JWT
+CREATE OR REPLACE FUNCTION public.email()
+RETURNS text
+LANGUAGE sql STABLE
+AS $$
+  SELECT
+  coalesce(
+    current_setting('request.jwt.claim.email', true),
+    (current_setting('request.jwt.claims', true)::jsonb ->> 'email')
+  )::text
 $$;

package/backend/src/infra/database/migrations/002_rename-auth-tables.sql

@@ -1,30 +1,30 @@
--- Migration: 002 - Rename authentication tables to better auth naming convention
-
-DO $$
-BEGIN
-    -- Handle _account to _oauth_connections
-    IF EXISTS (SELECT FROM information_schema.tables 
-              WHERE table_name = '_account' AND table_schema = 'public') THEN
-        IF EXISTS (SELECT FROM information_schema.tables 
-                   WHERE table_name = '_oauth_connections' AND table_schema = 'public') THEN
-            -- Both exist, drop the old one
-            DROP TABLE _account CASCADE;
-        ELSE
-            -- Only old exists, rename it
-            ALTER TABLE _account RENAME TO _oauth_connections;
-        END IF;
-    END IF;
-
-    -- Handle _user to _accounts
-    IF EXISTS (SELECT FROM information_schema.tables 
-              WHERE table_name = '_user' AND table_schema = 'public') THEN
-        IF EXISTS (SELECT FROM information_schema.tables 
-                   WHERE table_name = '_accounts' AND table_schema = 'public') THEN
-            -- Both exist, drop the old one
-            DROP TABLE _user CASCADE;
-        ELSE
-            -- Only old exists, rename it
-            ALTER TABLE _user RENAME TO _accounts;
-        END IF;
-    END IF;
+-- Migration: 002 - Rename authentication tables to better auth naming convention
+
+DO $$
+BEGIN
+    -- Handle _account to _oauth_connections
+    IF EXISTS (SELECT FROM information_schema.tables 
+              WHERE table_name = '_account' AND table_schema = 'public') THEN
+        IF EXISTS (SELECT FROM information_schema.tables 
+                   WHERE table_name = '_oauth_connections' AND table_schema = 'public') THEN
+            -- Both exist, drop the old one
+            DROP TABLE _account CASCADE;
+        ELSE
+            -- Only old exists, rename it
+            ALTER TABLE _account RENAME TO _oauth_connections;
+        END IF;
+    END IF;
+
+    -- Handle _user to _accounts
+    IF EXISTS (SELECT FROM information_schema.tables 
+              WHERE table_name = '_user' AND table_schema = 'public') THEN
+        IF EXISTS (SELECT FROM information_schema.tables 
+                   WHERE table_name = '_accounts' AND table_schema = 'public') THEN
+            -- Both exist, drop the old one
+            DROP TABLE _user CASCADE;
+        ELSE
+            -- Only old exists, rename it
+            ALTER TABLE _user RENAME TO _accounts;
+        END IF;
+    END IF;
 END $$;

package/backend/src/infra/database/migrations/003_create-users-table.sql

@@ -1,56 +1,56 @@
--- Migration: 003 - Create users table for user profiles
-
-DO $$
-BEGIN
-    CREATE TABLE IF NOT EXISTS users (
-      id UUID PRIMARY KEY REFERENCES _accounts(id) ON DELETE CASCADE,
-      nickname TEXT,
-      avatar_url TEXT,
-      bio TEXT,
-      birthday DATE,
-      created_at TIMESTAMPTZ DEFAULT NOW(),
-      updated_at TIMESTAMPTZ DEFAULT NOW()
-    );
-    
-    -- Check and create policies only if they don't exist
-    -- Allow everyone to read users table
-    IF NOT EXISTS (
-      SELECT 1 FROM pg_policies 
-      WHERE tablename = 'users' 
-      AND policyname = 'Enable read access for all users'
-    ) THEN
-      CREATE POLICY "Enable read access for all users" ON users
-        FOR SELECT
-        USING (true);  -- Allow all reads
-    END IF;
-    
-    IF NOT EXISTS (
-      SELECT 1 FROM pg_policies 
-      WHERE tablename = 'users' 
-      AND policyname = 'Disable delete for users'
-    ) THEN
-      CREATE POLICY "Disable delete for users" ON users
-        FOR DELETE
-        TO authenticated
-        USING (false);
-    END IF;
-
-    IF NOT EXISTS (
-      SELECT 1 FROM pg_policies 
-      WHERE tablename = 'users' 
-      AND policyname = 'Enable update for users based on user_id'
-    ) THEN
-      CREATE POLICY "Enable update for users based on user_id" ON users
-        FOR UPDATE
-        TO authenticated
-        USING (uid() = id)
-        WITH CHECK (uid() = id);  -- make sure only the owner can update
-    END IF;
-    
-    -- Enable Row Level Security on the users table
-    ALTER TABLE users ENABLE ROW LEVEL SECURITY;
-    
-    -- Grant permissions to anon and authenticated roles
-    GRANT SELECT ON users TO anon;
-    GRANT SELECT, UPDATE ON users TO authenticated;
+-- Migration: 003 - Create users table for user profiles
+
+DO $$
+BEGIN
+    CREATE TABLE IF NOT EXISTS users (
+      id UUID PRIMARY KEY REFERENCES _accounts(id) ON DELETE CASCADE,
+      nickname TEXT,
+      avatar_url TEXT,
+      bio TEXT,
+      birthday DATE,
+      created_at TIMESTAMPTZ DEFAULT NOW(),
+      updated_at TIMESTAMPTZ DEFAULT NOW()
+    );
+    
+    -- Check and create policies only if they don't exist
+    -- Allow everyone to read users table
+    IF NOT EXISTS (
+      SELECT 1 FROM pg_policies 
+      WHERE tablename = 'users' 
+      AND policyname = 'Enable read access for all users'
+    ) THEN
+      CREATE POLICY "Enable read access for all users" ON users
+        FOR SELECT
+        USING (true);  -- Allow all reads
+    END IF;
+    
+    IF NOT EXISTS (
+      SELECT 1 FROM pg_policies 
+      WHERE tablename = 'users' 
+      AND policyname = 'Disable delete for users'
+    ) THEN
+      CREATE POLICY "Disable delete for users" ON users
+        FOR DELETE
+        TO authenticated
+        USING (false);
+    END IF;
+
+    IF NOT EXISTS (
+      SELECT 1 FROM pg_policies 
+      WHERE tablename = 'users' 
+      AND policyname = 'Enable update for users based on user_id'
+    ) THEN
+      CREATE POLICY "Enable update for users based on user_id" ON users
+        FOR UPDATE
+        TO authenticated
+        USING (uid() = id)
+        WITH CHECK (uid() = id);  -- make sure only the owner can update
+    END IF;
+    
+    -- Enable Row Level Security on the users table
+    ALTER TABLE users ENABLE ROW LEVEL SECURITY;
+    
+    -- Grant permissions to anon and authenticated roles
+    GRANT SELECT ON users TO anon;
+    GRANT SELECT, UPDATE ON users TO authenticated;
 END $$;