-- Lets a Superadmin choose which sidebar modules a Junior Admin can see.
CREATE TABLE IF NOT EXISTS junior_admin_visibility (
  school_id       INTEGER PRIMARY KEY REFERENCES schools(id) ON DELETE CASCADE,
  visible_modules JSONB NOT NULL DEFAULT '[]',
  updated_at      TIMESTAMPTZ NOT NULL DEFAULT now()
);
ALTER TABLE junior_admin_visibility FORCE ROW LEVEL SECURITY;
ALTER TABLE junior_admin_visibility ENABLE ROW LEVEL SECURITY;
DROP POLICY IF EXISTS tenant_isolation ON junior_admin_visibility;
CREATE POLICY tenant_isolation ON junior_admin_visibility
  USING (school_id = NULLIF(current_setting('app.current_school_id', true), '')::int);