-- Cross-schema privileges are intentionally one-way: Bell publishes one view;
-- Sense cannot read Bell source tables or write any Bell object.

REVOKE ALL ON SCHEMA bell FROM PUBLIC;
REVOKE ALL ON ALL TABLES IN SCHEMA bell FROM PUBLIC;
REVOKE ALL ON ALL FUNCTIONS IN SCHEMA bell FROM PUBLIC;
REVOKE ALL ON SCHEMA sense FROM PUBLIC;
REVOKE ALL ON ALL TABLES IN SCHEMA sense FROM PUBLIC;

GRANT USAGE ON SCHEMA bell TO sense_app;
GRANT SELECT ON TABLE bell.site_quota_v1 TO sense_app;
REVOKE ALL ON TABLE bell.sites FROM sense_app;
REVOKE ALL ON TABLE bell.schema_migrations FROM sense_app;
REVOKE ALL ON FUNCTION bell.bump_site_version() FROM sense_app;

GRANT USAGE ON SCHEMA sense TO sense_app;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA sense TO sense_app;

ALTER DEFAULT PRIVILEGES FOR ROLE bell_app IN SCHEMA bell REVOKE ALL ON TABLES FROM PUBLIC;
ALTER DEFAULT PRIVILEGES FOR ROLE bell_app IN SCHEMA bell REVOKE ALL ON FUNCTIONS FROM PUBLIC;
ALTER DEFAULT PRIVILEGES FOR ROLE sense_app IN SCHEMA sense REVOKE ALL ON TABLES FROM PUBLIC;