RBAC multi-tenant

create table orgs (id uuid primary key default gen_random_uuid(), name text not null);
create table org_members (
  org_id   uuid references orgs(id) on delete cascade,
  user_id  uuid references auth.users(id) on delete cascade,
  roles    text[] not null default '{}',
  primary key (org_id, user_id)
);

Deno.serve(async (req) => {
  const { user, claims } = await req.json()
  const { data: m } = await aura
    .from('org_members')
    .select('org_id, roles')
    .eq('user_id', user.id).single()
  return Response.json({
    ...claims,
    tenant: m?.org_id,
    roles: m?.roles || [],
  })
})

-- Tout membre de l'org voit les projets
create policy "projects_read" on projects
  for select to authenticated
  using (org_id = auth.tenant());
-- Seul admin peut créer/supprimer
create policy "projects_admin" on projects
  for all to authenticated
  using (org_id = auth.tenant() and auth.has_role('admin'))
  with check (org_id = auth.tenant());