-- Allow logged-in dashboard users to read worker_events.
-- Apply after 0001_worker_events.sql.
--
-- This is intentionally permissive: any authenticated user can read every
-- row. If you need multi-tenant isolation, replace this with a policy that
-- joins on a per-user filter (e.g. a `users_clients` mapping table).

drop policy if exists "authenticated read all" on public.worker_events;
create policy "authenticated read all"
    on public.worker_events
    for select
    to authenticated
    using (true);
