-- Fix the customer orders RLS policy to avoid querying the users table
-- The original policy caused "permission denied for table users" errors

-- Drop the existing problematic policy
drop policy if exists "Customers can view their own orders" on public.orders;

-- Create a new policy that uses auth.jwt() to get email instead of querying users table
create policy "Customers can view their own orders"
  on public.orders for select
  using (
    auth.uid() is not null and
    customer_email = auth.jwt()->>'email'
  );
