-- Custom domain resolution needs to be readable by anon so the public web
-- app (apps/web/src/app/menu/[slug]/page.tsx) can map an arbitrary incoming
-- hostname -> restaurant without going through the API. Scoped to verified
-- domains on restaurants that actually have a published menu, matching the
-- same pattern as the restaurants/locations public policies.

create policy "anyone can resolve verified custom domains" on domains
  for select using (
    status = 'verified'
    and exists (
      select 1
      from locations l
      join menus m on m.location_id = l.id
      where l.restaurant_id = domains.restaurant_id and m.is_published = true
    )
  );