-- 1) data_plans: restrict direct reads to admin only
DROP POLICY IF EXISTS data_plans_read ON public.data_plans;
CREATE POLICY data_plans_admin_read ON public.data_plans
  FOR SELECT TO authenticated
  USING (public.has_role(auth.uid(), 'admin'::public.app_role));

-- 2) services: restrict direct reads to admin only
DROP POLICY IF EXISTS services_read_auth ON public.services;
CREATE POLICY services_admin_read ON public.services
  FOR SELECT TO authenticated
  USING (public.has_role(auth.uid(), 'admin'::public.app_role));

-- 3) profiles: only self can read via RLS; staff use admin server functions
DROP POLICY IF EXISTS profiles_self_select ON public.profiles;
CREATE POLICY profiles_self_select ON public.profiles
  FOR SELECT TO authenticated
  USING (auth.uid() = id);