22 lines
1.0 KiB
SQL
22 lines
1.0 KiB
SQL
|
-- Cross-schema privileges are intentionally one-way: Bell publishes one view;
|
||
|
|
-- Sense cannot read Bell source tables or write any Bell object.
|
||
|
|
|
||
|
|
REVOKE ALL ON SCHEMA bell FROM PUBLIC;
|
||
|
|
REVOKE ALL ON ALL TABLES IN SCHEMA bell FROM PUBLIC;
|
||
|
|
REVOKE ALL ON ALL FUNCTIONS IN SCHEMA bell FROM PUBLIC;
|
||
|
|
REVOKE ALL ON SCHEMA sense FROM PUBLIC;
|
||
|
|
REVOKE ALL ON ALL TABLES IN SCHEMA sense FROM PUBLIC;
|
||
|
|
|
||
|
|
GRANT USAGE ON SCHEMA bell TO sense_app;
|
||
|
|
GRANT SELECT ON TABLE bell.site_quota_v1 TO sense_app;
|
||
|
|
REVOKE ALL ON TABLE bell.sites FROM sense_app;
|
||
|
|
REVOKE ALL ON TABLE bell.schema_migrations FROM sense_app;
|
||
|
|
REVOKE ALL ON FUNCTION bell.bump_site_version() FROM sense_app;
|
||
|
|
|
||
|
|
GRANT USAGE ON SCHEMA sense TO sense_app;
|
||
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA sense TO sense_app;
|
||
|
|
|
||
|
|
ALTER DEFAULT PRIVILEGES FOR ROLE bell_app IN SCHEMA bell REVOKE ALL ON TABLES FROM PUBLIC;
|
||
|
|
ALTER DEFAULT PRIVILEGES FOR ROLE bell_app IN SCHEMA bell REVOKE ALL ON FUNCTIONS FROM PUBLIC;
|
||
|
|
ALTER DEFAULT PRIVILEGES FOR ROLE sense_app IN SCHEMA sense REVOKE ALL ON TABLES FROM PUBLIC;
|