Mega push vol 5, working on messaging now

supabase/migrations/018_user_avatars_storage.sql

@@ -0,0 +1,17 @@
+-- Allow authenticated users to upload to user-avatars folder
+CREATE POLICY "Authenticated users can upload user avatars"
+ON storage.objects FOR INSERT
+TO authenticated
+WITH CHECK (bucket_id = 'avatars' AND (storage.foldername(name))[1] = 'user-avatars');
+
+-- Allow authenticated users to update (upsert) their user avatars
+CREATE POLICY "Authenticated users can update user avatars"
+ON storage.objects FOR UPDATE
+TO authenticated
+USING (bucket_id = 'avatars' AND (storage.foldername(name))[1] = 'user-avatars');
+
+-- Allow authenticated users to delete user avatars
+CREATE POLICY "Authenticated users can delete user avatars"
+ON storage.objects FOR DELETE
+TO authenticated
+USING (bucket_id = 'avatars' AND (storage.foldername(name))[1] = 'user-avatars');

supabase/migrations/019_fix_org_members_profiles_fk.sql

@@ -0,0 +1,8 @@
+-- Fix: org_members.user_id references auth.users(id) but PostgREST needs a FK
+-- to public.profiles for embedded joins like `profiles:user_id (...)` to work.
+-- Since profiles.id mirrors auth.users.id, we add a second FK to profiles.
+
+-- Add FK from org_members.user_id to profiles.id
+ALTER TABLE org_members
+  ADD CONSTRAINT org_members_user_id_profiles_fk
+  FOREIGN KEY (user_id) REFERENCES profiles(id) ON DELETE CASCADE;