-- Meduvo production hardening: audit_logs DB-level append-only enforcement.
--
-- Run as a MySQL administrative user in each non-local environment after
-- creating a dedicated application database user. Do not run this against
-- the local XAMPP root user; root can bypass grants and owns the rest of
-- the development schema.
--
-- Replace:
--   meduvo_prod       with the production database name
--   meduvo_app        with the application database username
--   %                 with the app host pattern, when it is narrower
--
-- The app still needs INSERT/SELECT on audit_logs to record and display the
-- compliance trail. It must not be able to UPDATE or DELETE historical
-- audit rows.

REVOKE UPDATE, DELETE ON `meduvo_prod`.`audit_logs` FROM 'meduvo_app'@'%';
GRANT SELECT, INSERT ON `meduvo_prod`.`audit_logs` TO 'meduvo_app'@'%';
FLUSH PRIVILEGES;

-- Verification: these should show SELECT and INSERT, but no UPDATE/DELETE
-- privilege for meduvo_prod.audit_logs.
SHOW GRANTS FOR 'meduvo_app'@'%';