-- Relax the projects table RLS to match operators + clients
-- (20260524000001): any org member can SELECT and INSERT. UPDATE
-- and DELETE still allowed at the row level too — owner-only
-- operations (income write, billout adjustments) are gated at the
-- APP layer via canTransfer / canSeeIncome, not RLS. Managers
-- don't have direct SQL access, so this app-layer gate is
-- sufficient.
--
-- Why: the import resolver inserts new project rows on behalf of
-- the user who's running the import. Adi (manager) couldn't
-- complete imports because the prior policy required is_org_owner.
-- The error surfaced as "Failed to create project: new row
-- violates row-level security policy for table projects" during
-- commit. Confirmed via screenshot 2026-06-09.

drop policy if exists "projects_select_owner" on public.projects;
drop policy if exists "projects_modify_owner" on public.projects;

drop policy if exists "projects_all_org_member" on public.projects;
create policy "projects_all_org_member"
  on public.projects for all
  to authenticated
  using (public.is_org_member(org_id))
  with check (public.is_org_member(org_id));
