-- PANELS · Postgres · Fase 0 (privilegios dentro de panels_platform)
--
-- Correr conectado A LA BASE panels_platform (no a "postgres"), como
-- superuser/admin: psql "$SUPERUSER_URL/panels_platform" -f 03-platform-database.sql
--
-- panels_platform es de un solo esquema (public) porque es un control
-- plane simple (tenants, platform_users, smtp_settings) usado solo por
-- las rutas /v1/saas/*. No se subdivide en más esquemas.

REVOKE ALL ON SCHEMA public FROM PUBLIC;

GRANT USAGE, CREATE ON SCHEMA public TO panels_platform_owner;
GRANT USAGE ON SCHEMA public TO panels_platform_app;

-- Privilegios por defecto para tablas/secuencias que cree panels_platform_owner
-- (vía Liquibase) a partir de ahora: panels_platform_app solo puede hacer DML,
-- nunca DDL.
ALTER DEFAULT PRIVILEGES FOR ROLE panels_platform_owner IN SCHEMA public
  GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO panels_platform_app;
ALTER DEFAULT PRIVILEGES FOR ROLE panels_platform_owner IN SCHEMA public
  GRANT USAGE, SELECT ON SEQUENCES TO panels_platform_app;

-- Objetos que ya existan (si esto corre después de la primera migración de Liquibase)
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO panels_platform_app;
GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO panels_platform_app;