create table if not exists parent_cases ( id bigint generated by default as identity primary key, created_at timestamptz not null default now(), updated_at timestamptz not null default now(), case_type text default 'Parent', parent_name text not null, contact text, student_name text, tutor text, category text, priority text default 'Medium', description text, stage text not null default 'new', updates jsonb not null default '[]'::jsonb, resolution text, resolved_at timestamptz ); alter table parent_cases enable row level security; -- Access rule: admins see every case; tutors only cases assigned to them. create or replace function eps_case_access(case_tutor text) returns boolean language sql stable security definer set search_path = public as $$ select exists ( select 1 from tutors t where lower(t.email) = lower(auth.jwt()->>'email') and (t.is_admin or t.name = case_tutor) ); $$; drop policy if exists "parent_cases_all" on parent_cases; drop policy if exists "parent_cases_select" on parent_cases; drop policy if exists "parent_cases_insert" on parent_cases; drop policy if exists "parent_cases_update" on parent_cases; drop policy if exists "parent_cases_delete" on parent_cases; create policy "parent_cases_select" on parent_cases for select to authenticated using (eps_case_access(tutor)); create policy "parent_cases_insert" on parent_cases for insert to authenticated with check (eps_case_access(tutor)); create policy "parent_cases_update" on parent_cases for update to authenticated using (eps_case_access(tutor)) with check (eps_case_access(tutor)); create policy "parent_cases_delete" on parent_cases for delete to authenticated using (eps_case_access(tutor));