-- Drop old policies that reference orders table
DROP POLICY IF EXISTS "history select by order role" ON order_history;
DROP POLICY IF EXISTS "history insert workflow" ON order_history;

-- New SELECT policy: users can read history for order_groups they have access to
CREATE POLICY "order_history_select" ON order_history
FOR SELECT TO authenticated
USING (
  EXISTS (
    SELECT 1 FROM order_groups og
    WHERE og.id = order_history.order_group_id
    AND (
      current_role_name() = ANY (ARRAY['admin', 'mega_admin', 'production_lead'])
      OR (current_role_name() = 'manager')
      OR (current_role_name() = 'logistician')
      OR (current_role_name() = 'driver' AND og.assigned_driver_id = auth.uid())
    )
  )
);

-- INSERT policy: only trigger (SECURITY DEFINER) inserts, users don't insert directly
CREATE POLICY "order_history_insert_trigger" ON order_history
FOR INSERT TO authenticated
WITH CHECK (true);