 grant update on table sg_public.user to sg_user, sg_admin;
 create policy update_user on sg_public.user
   for update (name, view_subjects) to sg_user
-  using (id = current_setting('jwt.claims.user_id')::uuid);
+  using (id = current_setting('jwt.claims.user_id')::uuid); -- TODO comment
 create policy update_user_admin on sg_public.user
   for update to sg_admin
-  using (true);
+  using (true); -- TODO comment
 
 -- Delete user: user self, or admin.
 grant delete on table sg_public.user to sg_user, sg_admin;
 create policy delete_user on sg_public.user
   for delete to sg_user
-  using (id = current_setting('jwt.claims.user_id')::uuid);
+  using (id = current_setting('jwt.claims.user_id')::uuid); -- TODO comment
 create policy delete_user_admin on sg_public.user
   for delete to sg_admin
-  using (true);
+  using (true); -- TODO comment
 
 -- All users may log in or check the current user.
 grant execute on function sg_public.log_in(text, text) to sg_anonymous, sg_user, sg_admin;

grant update on table sg_public.notice to sg_user, sg_admin;
create policy update_notice on sg_public.notice
  for update (read) to sg_user, sg_admin
  using (user_id = current_setting('jwt.claims.user_id')::uuid);

-- Delete notice: user or admin self.
grant delete on table sg_public.notice to sg_user, sg_admin;
create policy delete_notice on sg_public.notice
  for delete to sg_user, sg_admin
  using (user_id = current_setting('jwt.claims.user_id')::uuid);

-- todo function permissions...


grant select on table sg_public.user to sg_anonymous, sg_user, sg_admin;
create policy select_user on sg_public.user
  for select -- any user
  using (true); -- TODO comment

-- Insert user: only anonymous, via function.
grant execute on function sg_public.sign_up(text, text, text) to sg_anonymous;
