-- Allow subs to delete their own draft or submitted invoices (not paid)
drop policy if exists "Sub delete own draft invoices" on public.subcontractor_invoices;

create policy "Sub delete own unpaid invoices" on public.subcontractor_invoices
  for delete using (profile_id = auth.uid() and get_my_role() = 'external' and status != 'paid');