-- Run once in Supabase SQL Editor — persistent storage for attendance screenshots.
-- New uploads go to this bucket (survives backend redeploys).

insert into storage.buckets (id, name, public, file_size_limit, allowed_mime_types)
values (
  'attendance-screenshots',
  'attendance-screenshots',
  true,
  5242880,
  array['image/jpeg', 'image/jpg', 'image/webp', 'image/png']
)
on conflict (id) do update set
  public = excluded.public,
  file_size_limit = excluded.file_size_limit,
  allowed_mime_types = excluded.allowed_mime_types;

-- Public read (dashboard / admin viewers)
drop policy if exists "Public read attendance screenshots" on storage.objects;
create policy "Public read attendance screenshots"
on storage.objects for select
to public
using (bucket_id = 'attendance-screenshots');

-- Backend service role uploads (RLS bypassed for service role, policy for clarity)
drop policy if exists "Service upload attendance screenshots" on storage.objects;
create policy "Service upload attendance screenshots"
on storage.objects for insert
to authenticated, service_role
with check (bucket_id = 'attendance-screenshots');