-- Run as a DBA after provisioning the account with a strong externally managed
-- password and the correct application host restriction. Do not run from PHP.
-- Substitute the account/host/database to match the production deployment.
GRANT SELECT ON huntingclubroster.* TO 'hcr_runtime'@'app-host.example';
GRANT INSERT, UPDATE, DELETE ON huntingclubroster.users TO 'hcr_runtime'@'app-host.example';
GRANT INSERT, UPDATE, DELETE ON huntingclubroster.password_resets TO 'hcr_runtime'@'app-host.example';
GRANT INSERT, UPDATE, DELETE ON huntingclubroster.auth_attempts TO 'hcr_runtime'@'app-host.example';
GRANT INSERT, DELETE ON huntingclubroster.email_verifications TO 'hcr_runtime'@'app-host.example';
GRANT INSERT, UPDATE, DELETE ON huntingclubroster.alerts TO 'hcr_runtime'@'app-host.example';
GRANT INSERT, UPDATE, DELETE ON huntingclubroster.dropdowns TO 'hcr_runtime'@'app-host.example';
GRANT INSERT, UPDATE, DELETE ON huntingclubroster.dropdowntypes TO 'hcr_runtime'@'app-host.example';
GRANT INSERT, UPDATE, DELETE ON huntingclubroster.notes TO 'hcr_runtime'@'app-host.example';
GRANT INSERT, UPDATE, DELETE ON huntingclubroster.popovers TO 'hcr_runtime'@'app-host.example';
GRANT INSERT, UPDATE, DELETE ON huntingclubroster.statuses TO 'hcr_runtime'@'app-host.example';
GRANT INSERT ON huntingclubroster.journal TO 'hcr_runtime'@'app-host.example';
GRANT INSERT, UPDATE ON huntingclubroster.clubs TO 'hcr_runtime'@'app-host.example';
GRANT INSERT, UPDATE ON huntingclubroster.club_memberships TO 'hcr_runtime'@'app-host.example';
GRANT INSERT ON huntingclubroster.club_seasons TO 'hcr_runtime'@'app-host.example';
GRANT INSERT ON huntingclubroster.club_dues TO 'hcr_runtime'@'app-host.example';
GRANT INSERT ON huntingclubroster.club_payments TO 'hcr_runtime'@'app-host.example';
GRANT INSERT ON huntingclubroster.club_due_adjustments TO 'hcr_runtime'@'app-host.example';
GRANT INSERT ON huntingclubroster.club_payment_reversals TO 'hcr_runtime'@'app-host.example';
-- No schema-changing privileges, journal UPDATE/DELETE, or financial UPDATE/DELETE.
-- Use separate credentials for migrations and backup/restore jobs.

GRANT INSERT, UPDATE ON huntingclubroster.club_invitations TO 'hcr_runtime'@'app-host.example';
GRANT INSERT, UPDATE ON huntingclubroster.club_tickets TO 'hcr_runtime'@'app-host.example';
GRANT INSERT ON huntingclubroster.club_ticket_messages TO 'hcr_runtime'@'app-host.example';

GRANT INSERT, UPDATE, DELETE ON huntingclubroster.user_mfa TO 'hcr_runtime'@'app-host.example';
GRANT INSERT, DELETE ON huntingclubroster.mfa_recovery TO 'hcr_runtime'@'app-host.example';
GRANT INSERT, UPDATE ON huntingclubroster.club_resource_usage TO 'hcr_runtime'@'app-host.example';