-- Least-privilege grants for SovereignRepository (run after migrate)
-- Replace [DOMAIN\SvcSovereign] with your repository service account.

USE SovereignRepository;
GO

IF NOT EXISTS (SELECT 1 FROM sys.database_principals WHERE name = N'dbaops_sovereign_app')
  CREATE ROLE dbaops_sovereign_app;
GO

GRANT SELECT, INSERT, UPDATE, DELETE ON SCHEMA::ctl TO dbaops_sovereign_app;
GRANT SELECT, INSERT, UPDATE, DELETE ON SCHEMA::perf TO dbaops_sovereign_app;
GRANT SELECT, INSERT, UPDATE, DELETE ON SCHEMA::sec TO dbaops_sovereign_app;
GRANT SELECT, INSERT, UPDATE, DELETE ON SCHEMA::comp TO dbaops_sovereign_app;
GRANT SELECT, INSERT, UPDATE, DELETE ON SCHEMA::inv TO dbaops_sovereign_app;
GRANT SELECT, INSERT, UPDATE, DELETE ON SCHEMA::patch TO dbaops_sovereign_app;
GRANT SELECT, INSERT, UPDATE, DELETE ON SCHEMA::config TO dbaops_sovereign_app;
GRANT SELECT, INSERT, UPDATE, DELETE ON SCHEMA::deploy TO dbaops_sovereign_app;
GRANT EXECUTE ON SCHEMA::ctl TO dbaops_sovereign_app;
GO

-- Example: map Windows service account to role (uncomment and edit)
-- CREATE USER [DOMAIN\SvcSovereign] FROM LOGIN [DOMAIN\SvcSovereign];
-- ALTER ROLE dbaops_sovereign_app ADD MEMBER [DOMAIN\SvcSovereign];
GO
