create table if not exists restaurants ( id uuid default gen_random_uuid() primary key, user_id uuid references auth.users not null, name text default 'My Restaurant', type text default 'casual', currency text default '₹', seats integer default 0, created_at timestamptz default now(), unique (user_id) ); create table if not exists monthly_entries ( id uuid default gen_random_uuid() primary key, user_id uuid references auth.users not null, month text not null, year integer not null, income jsonb default '{}', cogs jsonb default '{}', labor jsonb default '{}', overhead jsonb default '{}', marketing jsonb default '{}', maintenance jsonb default '{}', updated_at timestamptz default now(), unique (user_id, month, year) ); alter table restaurants enable row level security; alter table monthly_entries enable row level security; create policy "own_restaurant" on restaurants for all using (auth.uid() = user_id) with check (auth.uid() = user_id); create policy "own_entries" on monthly_entries for all using (auth.uid() = user_id) with check (auth.uid() = user_id); -- Security audit log: records auth events and anomalies create table if not exists security_logs ( id uuid default gen_random_uuid() primary key, user_id uuid references auth.users, event_type text not null, severity text not null default 'info', ip_hint text, details jsonb default '{}', created_at timestamptz default now() ); -- Only authenticated users can insert their own logs; no one can read or update alter table security_logs enable row level security; create policy "insert_own_log" on security_logs for insert with check (auth.uid() = user_id); -- Indexes for efficient querying by event type and time create index if not exists idx_sec_logs_user on security_logs(user_id, created_at desc); create index if not exists idx_sec_logs_type on security_logs(event_type, created_at desc); -- Rate limit function: count recent events per user create or replace function check_auth_rate_limit(p_user_id uuid, p_window_minutes int, p_max_events int) returns boolean language sql security definer as $$ select count(*) < p_max_events from security_logs where user_id = p_user_id and event_type = 'auth_failure' and created_at > now() - (p_window_minutes || ' minutes')::interval; $$;