-- Execute as the migration owner in the CARLA database AFTER the migration.
-- Create carla_runtime separately, with its password supplied through secrets.
GRANT CONNECT ON DATABASE carla TO carla_runtime;
GRANT USAGE ON SCHEMA public TO carla_runtime;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO carla_runtime;
GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO carla_runtime;
REVOKE UPDATE, DELETE, TRUNCATE ON entry_revisions, revision_files, audit_events FROM carla_runtime;
REVOKE ALL ON alembic_version FROM carla_runtime;
-- Grant defaults for future objects deliberately as part of each migration.