16 lines
737 B
SQL
16 lines
737 B
SQL
-- Runtime Bell can append/read event facts but cannot rewrite, delete or
|
|
-- truncate them. Object ownership stays with the offline migration role.
|
|
|
|
REVOKE ALL ON FUNCTION bell.reject_immutable_change() FROM PUBLIC;
|
|
REVOKE ALL ON TABLE bell.events, bell.event_outcomes FROM PUBLIC;
|
|
REVOKE ALL ON TABLE bell.events, bell.event_outcomes FROM bell_runtime;
|
|
|
|
GRANT USAGE ON SCHEMA bell TO bell_runtime;
|
|
GRANT SELECT ON TABLE bell.schema_migrations TO bell_runtime;
|
|
GRANT SELECT, INSERT ON TABLE bell.events, bell.event_outcomes TO bell_runtime;
|
|
|
|
ALTER DEFAULT PRIVILEGES FOR ROLE bell_app IN SCHEMA bell
|
|
REVOKE ALL ON TABLES FROM PUBLIC;
|
|
ALTER DEFAULT PRIVILEGES FOR ROLE bell_app IN SCHEMA bell
|
|
REVOKE ALL ON FUNCTIONS FROM PUBLIC;
|