\set ON_ERROR_STOP on

-- Run with: psql ... --set=adapter_role=knowledge_adapter_weknora_ro -f this-file
-- The named role must be a dedicated NOINHERIT login with no other memberships.
BEGIN;

REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA public FROM :"adapter_role";
REVOKE ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public FROM :"adapter_role";
REVOKE CREATE ON SCHEMA public FROM :"adapter_role";

GRANT USAGE ON SCHEMA public TO :"adapter_role";
GRANT SELECT (handle, tenant_id, storage_backend_id, provider, physical_path, mime_type, state, deleted_at)
    ON TABLE public.resources TO :"adapter_role";

COMMIT;