-- Workflows table
CREATE TABLE workflows (
  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
  user_id UUID REFERENCES auth.users(id) ON DELETE CASCADE,
  name TEXT,
  data JSONB NOT NULL,
  created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
  updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
);

-- Agent configurations table
CREATE TABLE agent_configs (
  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
  user_id UUID REFERENCES auth.users(id) ON DELETE CASCADE,
  element_id TEXT NOT NULL,
  agent_id TEXT NOT NULL,
  config JSONB NOT NULL,
  created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
  updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
  UNIQUE(user_id, element_id)
);

-- API keys table (encrypted)
CREATE TABLE api_keys (
  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
  user_id UUID REFERENCES auth.users(id) ON DELETE CASCADE,
  element_id TEXT NOT NULL,
  encrypted_key TEXT NOT NULL,
  model TEXT,
  prompt TEXT,
  created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
  updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
  UNIQUE(user_id, element_id)
);

-- Agent connections table
CREATE TABLE agent_connections (
  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
  workflow_id UUID REFERENCES workflows(id) ON DELETE CASCADE,
  source_element_id TEXT NOT NULL,
  target_element_id TEXT NOT NULL,
  created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
);

-- Enable Row Level Security
ALTER TABLE workflows ENABLE ROW LEVEL SECURITY;
ALTER TABLE agent_configs ENABLE ROW LEVEL SECURITY;
ALTER TABLE api_keys ENABLE ROW LEVEL SECURITY;
ALTER TABLE agent_connections ENABLE ROW LEVEL SECURITY;

-- Create policies
CREATE POLICY "Users can manage their own workflows"
  ON workflows FOR ALL
  USING (auth.uid() = user_id);

CREATE POLICY "Users can manage their own configs"
  ON agent_configs FOR ALL
  USING (auth.uid() = user_id);

CREATE POLICY "Users can manage their own API keys"
  ON api_keys FOR ALL
  USING (auth.uid() = user_id);

CREATE POLICY "Users can manage their own connections"
  ON agent_connections FOR ALL
  USING (workflow_id IN (
    SELECT id FROM workflows WHERE user_id = auth.uid()
  ));

// Keys are encrypted using Supabase's built-in encryption
await fetch(`${supabaseUrl}/functions/v1/manage-api-keys`, {
  method: 'POST',
  body: JSON.stringify({
    action: 'save',
    elementId,
    apiKey // Encrypted server-side
  })
});

CREATE POLICY "Users can manage their own workflows"
  ON workflows FOR ALL
  USING (auth.uid() = user_id);

https://your-app.vercel.app/gmail-oauth-callback