-- =====================================================================
-- A&B Hub — Application Database User (least privilege)
--
-- Run this once as a MySQL admin/root user when setting up a new
-- environment, BEFORE running bin/migrate.php as this new user. The
-- app should never connect as root — DB_USERNAME/DB_PASSWORD in .env
-- should be this dedicated account.
--
-- Usage:
--   mysql -u root -p < deploy/GRANTS.sql
-- (edit the password below first)
-- =====================================================================

CREATE DATABASE IF NOT EXISTS ab_hub CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;

CREATE USER IF NOT EXISTS 'ab_hub_app'@'localhost' IDENTIFIED BY 'CHANGE_ME_TO_A_STRONG_RANDOM_PASSWORD';

-- DML + DDL (migrations run as this same user) on this one database
-- only — no access to any other schema, no GRANT OPTION, no global
-- privileges (no SUPER, no FILE, no PROCESS).
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, ALTER, INDEX, DROP, REFERENCES
    ON ab_hub.* TO 'ab_hub_app'@'localhost';

FLUSH PRIVILEGES;