create table if not exists public.invoices (
  id               text          primary key,
  public_token     uuid          not null default gen_random_uuid(),
  user_id          uuid          not null references auth.users(id) on delete cascade,
  client           text          not null,
  client_email     text,
  issue_date       date,
  due_date         date,
  notes            text,
  items            jsonb         not null default '[]',
  total            numeric(12,2) not null default 0,
  subtotal         numeric(12,2) default 0,
  vat_amount       numeric(12,2) default 0,
  vat_rate         numeric(5,2)  default 0,
  ritenuta_amount  numeric(12,2) default 0,
  tax_name         text,
  status           text          not null default 'pending' check (status in ('pending','approved','paid')),
  created_at       timestamptz   not null default now()
);

create table if not exists public.settings (
  user_id          uuid          primary key references auth.users(id) on delete cascade,
  name             text,
  email            text,
  vat              text,
  vat2             text,
  address          text,
  iban             text,
  country          text          default 'IT',
  default_rate     numeric(10,2) default 50,
  tax_rate         numeric(5,2)  default 15,
  vat_on_invoice   numeric(5,2)  default 22,
  vat_enabled      boolean       default true,
  ritenuta         boolean       default false,
  kleinunternehmer boolean       default false,
  autoentrepreneur boolean       default false,
  currency         text          default 'EUR',
  terms            text,
  due_days         integer       default 30,
  lang             text          default 'it',
  updated_at       timestamptz   default now()
);

alter table public.invoices enable row level security;
alter table public.settings  enable row level security;

create policy "owner_invoices" on public.invoices for all to authenticated
  using (auth.uid() = user_id) with check (auth.uid() = user_id);

create policy "anon_read" on public.invoices for select to anon using (true);

create policy "anon_approve" on public.invoices for update to anon
  using (status = 'pending') with check (status = 'approved');

create policy "owner_settings" on public.settings for all to authenticated
  using (auth.uid() = user_id) with check (auth.uid() = user_id);