-- Fix PII exposure: Tighten SELECT RLS policies
-- Previously: profiles, companies, worker_profiles had SELECT USING (true)
-- which exposed phone, email, ABN, address, white_card_number to anon users.
-- Fix: Restrict SELECT to authenticated users only.

-- 1. PROFILES
DROP POLICY IF EXISTS "Public profiles are viewable by everyone" ON profiles;
CREATE POLICY "Profiles viewable by authenticated users"
  ON profiles FOR SELECT
  TO authenticated
  USING (true);

-- 2. COMPANIES
DROP POLICY IF EXISTS "Companies are viewable by everyone" ON companies;
CREATE POLICY "Companies viewable by authenticated users"
  ON companies FOR SELECT
  TO authenticated
  USING (true);

-- 3. WORKER PROFILES
DROP POLICY IF EXISTS "Worker profiles are viewable by everyone" ON worker_profiles;
CREATE POLICY "Worker profiles viewable by authenticated users"
  ON worker_profiles FOR SELECT
  TO authenticated
  USING (true);
