-- Part 2 (isolated, same careful-paste treatment as 0036a): the
-- invoices_update_approver policy change from the original 0036,
-- confirmed still required by a live test after 0036a alone landed —
-- Edwin's self-approve was blocked with "new row violates row-level
-- security policy for table \"invoices\"" (not the trigger's old
-- exception, which confirmed 0036a's fix DID take effect), because
-- invoices_update_owner's own WITH CHECK (0008) restricts the
-- resulting status to draft/submitted/rejected -- excluding
-- 'approved' outright -- so invoices_update_approver is the ONLY
-- policy that can ever permit this write, and it still unconditionally
-- excludes self-invoices without this change.
--
-- Same is_admin OR-exception as 0036a, applied to the self-invoice
-- exclusion here instead of the trigger. Only this one policy's
-- definition changes; every other invoices policy is untouched.
drop policy if exists "invoices_update_approver" on public.invoices;
create policy "invoices_update_approver"
on public.invoices
for update
to authenticated
using (
  public.has_permission('invoicing', need_write => true)
  and (
    agent_id is distinct from public.current_agent_id()
    or exists (select 1 from public.profiles where id = auth.uid() and is_admin = true)
  )
)
with check (
  public.has_permission('invoicing', need_write => true)
  and (
    agent_id is distinct from public.current_agent_id()
    or exists (select 1 from public.profiles where id = auth.uid() and is_admin = true)
  )
);