SC/ST Solar Rooftop (SRT) Services Portal

Even if someone inspects the browser or APK network traffic, Supabase PostgreSQL RLS / Firebase Security Rules block unauthorized access at the database server level:

-- Supabase / PostgreSQL Row-Level Security Policy (Zero Leak)
ALTER TABLE srt_services ENABLE ROW LEVEL SECURITY;

-- 1. Section AE can ONLY update rows in their own assigned Section
CREATE POLICY "ae_strict_section_update" ON srt_services
FOR UPDATE TO authenticated
USING (auth.jwt() ->> 'role' = 'SECTION' AND section_name = (auth.jwt() ->> 'section'));

-- 2. DEE/O/Palakonda (4 Sec) & DEE/O/Kurupam ITDA (3 Sec) Sub-Div Control
CREATE POLICY "dee_subdiv_update" ON srt_services
FOR UPDATE TO authenticated
USING (auth.jwt() ->> 'role' = 'SUB_DIVISION' AND sub_div = (auth.jwt() ->> 'sub_div'));

-- 3. Vendor (Sadbhav) can ONLY view DEFECT_REPORTED rows & upload Rectification
CREATE POLICY "vendor_strict_rectify_only" ON srt_services
FOR UPDATE TO authenticated
USING (auth.jwt() ->> 'role' = 'VENDOR' AND status IN ('DEFECT_REPORTED', 'RECTIFIED_PENDING_APPROVAL'));