-- Storage buckets for Nanga Kathai (files live on the server disk: volumes/storage).
-- Public buckets are readable at https://<domain>/storage/v1/object/public/<bucket>/<path>.
-- Free legacy songs are public; premium songs will move to a private bucket with signed URLs.

insert into storage.buckets (id, name, public, file_size_limit, allowed_mime_types) values
  ('audio',            'audio',            true,  52428800, array['audio/mpeg','audio/mp4','audio/aac','audio/x-m4a','audio/wav']),
  ('covers',           'covers',           true,  5242880,  array['image/jpeg','image/png','image/webp']),
  ('singer-photos',    'singer-photos',    true,  5242880,  array['image/jpeg','image/png','image/webp']),
  ('consent-evidence', 'consent-evidence', false, 10485760, array['image/jpeg','image/png','application/pdf'])
on conflict (id) do nothing;

-- Only admins upload, replace or delete files. consent-evidence is admin-read only.
create policy nk_admin_manage_files on storage.objects for all to authenticated
  using (bucket_id in ('audio','covers','singer-photos','consent-evidence') and public.is_admin())
  with check (bucket_id in ('audio','covers','singer-photos','consent-evidence') and public.is_admin());