{"-- CRITICAL SECURITY FIX: Remove the dangerous policy that allows public access to all subscribers
DROP POLICY IF EXISTS \"Service role can manage all subscriptions\" ON public.subscribers","DROP POLICY IF EXISTS \"Public access to subscribers\" ON public.subscribers","DROP POLICY IF EXISTS \"Enable read access for all users\" ON public.subscribers","-- Ensure RLS is enabled
ALTER TABLE public.subscribers ENABLE ROW LEVEL SECURITY","-- Create secure policy for organization admins to view subscribers in their org only
CREATE POLICY \"Org admins can view org subscribers\" 
ON public.subscribers 
FOR SELECT 
USING (
  EXISTS (
    SELECT 1 FROM public.user_roles ur
    WHERE ur.user_id = auth.uid() 
    AND ur.organization_id = subscribers.organization_id
    AND ur.role = 'admin'::user_role
  )
)","-- Create policy for system operations (signup process) with proper constraints
CREATE POLICY \"System can insert new subscribers\" 
ON public.subscribers 
FOR INSERT 
WITH CHECK (auth.uid() = user_id)"}