-- =============================================================================
-- 08_users.sql — ClickHouse users and grants
-- TODO: Replace 'ChangeMe' with strong passwords before production use.
--       Store passwords in a secrets manager (Vault, K8s secrets, etc.).
-- =============================================================================

CREATE USER IF NOT EXISTS data_writer IDENTIFIED WITH plaintext_password BY 'ChangeMe';
CREATE USER IF NOT EXISTS analyst     IDENTIFIED WITH plaintext_password BY 'ChangeMe';

-- data_writer: INSERT on raw table only (fed by correlator service)
GRANT INSERT ON mabase_prod.http_logs_raw TO data_writer;
GRANT SELECT ON mabase_prod.http_logs_raw TO data_writer;

-- analyst: read access on parsed and derived tables
GRANT SELECT ON mabase_prod.http_logs              TO analyst;
GRANT SELECT ON mabase_prod.ml_detected_anomalies  TO analyst;
GRANT SELECT ON mabase_prod.ml_all_scores          TO analyst;
GRANT SELECT ON mabase_prod.view_ai_features_1h    TO analyst;
GRANT SELECT ON mabase_prod.view_ip_recurrence     TO analyst;
GRANT SELECT ON mabase_prod.audit_logs             TO analyst;
