19 lines
778 B
SQL
19 lines
778 B
SQL
|
-- Extend the T-009 least-privilege boundary to the Area projection and new
|
||
|
|
-- Sense-owned state. Reapplying this file is intentional and safe.
|
||
|
|
|
||
|
|
REVOKE ALL ON TABLE bell.area_policy_v1 FROM PUBLIC;
|
||
|
|
REVOKE ALL ON TABLE bell.areas FROM PUBLIC;
|
||
|
|
REVOKE ALL ON FUNCTION bell.bump_area_version() FROM PUBLIC;
|
||
|
|
|
||
|
|
GRANT USAGE ON SCHEMA bell TO sense_app;
|
||
|
|
GRANT SELECT ON TABLE bell.area_policy_v1 TO sense_app;
|
||
|
|
REVOKE ALL ON TABLE bell.areas FROM sense_app;
|
||
|
|
REVOKE ALL ON FUNCTION bell.bump_area_version() FROM sense_app;
|
||
|
|
|
||
|
|
REVOKE ALL ON TABLE sense.area_policy_projection_state FROM PUBLIC;
|
||
|
|
REVOKE ALL ON TABLE sense.device_operation_outbox FROM PUBLIC;
|
||
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE
|
||
|
|
sense.area_policy_projection_state,
|
||
|
|
sense.device_operation_outbox
|
||
|
|
TO sense_app;
|