RBAC multi-tenant

create table orgs (id uuid primary key default gen_random_uuid(), name text not null);
create table org_members (
  org_id   uuid references orgs(id) on delete cascade,
  user_id  uuid references auth.users(id) on delete cascade,
  roles    text[] not null default '{}',
  primary key (org_id, user_id)
);

export default edge.hook('auth.sign', async ({ user, claims }) => {
  const { data: m } = await aura
    .from('org_members')
    .select('org_id, roles')
    .eq('user_id', user.id).single()
  return { ...claims, tenant: m.org_id, roles: m.roles }
})

-- Tout membre de l'org voit les projets
create policy "projects_read" on projects
  for select to authenticated
  using (org_id = auth.tenant());
-- Seul admin peut créer/supprimer
create policy "projects_admin" on projects
  for all to authenticated
  using (org_id = auth.tenant() and auth.has_role('admin'))
  with check (org_id = auth.tenant());