import 'package:supabase_flutter/supabase_flutter.dart';

/// Call after sign-in and on app start to enforce app-level profile lock.
/// If the user's `profiles.is_locked` flag is true, this signs out the user.
Future<void> enforceLockForCurrentUser(SupabaseClient supabase) async {
  final user = supabase.auth.currentUser;
  if (user == null) return;

  try {
    final record = await supabase
        .from('profiles')
        .select('is_locked')
        .eq('id', user.id)
        .maybeSingle();

    if (record == null) return;
    if (record['is_locked'] == true) {
      await supabase.auth.signOut();
    }
  } catch (_) {
    // swallow; enforcement is a best-effort client-side check
  }
}