-- Backend platform-admin flows only need to validate a supplied Auth UUID. Do
-- not grant the API role direct access to auth.users or its profile metadata.
create or replace function app.auth_user_exists(target_user_id uuid)
returns boolean
language sql
stable
security definer
set search_path = ''
as $$
  select exists (
    select 1
    from auth.users auth_user
    where auth_user.id = target_user_id
  )
$$;

revoke all on function app.auth_user_exists(uuid)
  from public, anon, authenticated, service_role, tiku_api, tiku_worker;
grant execute on function app.auth_user_exists(uuid) to tiku_api;

comment on function app.auth_user_exists(uuid) is
  'Minimal Auth boundary for the trusted API role; returns existence only and exposes no auth.users profile fields.';