-- Shows whether the application user's rights are correct. Run it as the database owner.
-- Replace cpuser_posapp with your application user's name. Every row should say OK.
SELECT check_name,
       CASE WHEN passed THEN 'OK' ELSE 'WRONG: run db/grants.sql again' END AS result
FROM (VALUES
  ('app user cannot UPDATE the stock ledger',
     NOT has_table_privilege('cpuser_posapp', 'public.stock_movements', 'UPDATE')),
  ('app user cannot DELETE from the stock ledger',
     NOT has_table_privilege('cpuser_posapp', 'public.stock_movements', 'DELETE')),
  ('app user cannot UPDATE the audit log',
     NOT has_table_privilege('cpuser_posapp', 'public.audit_log', 'UPDATE')),
  ('app user cannot DELETE from the audit log',
     NOT has_table_privilege('cpuser_posapp', 'public.audit_log', 'DELETE')),
  ('app user can add ledger entries',
     has_table_privilege('cpuser_posapp', 'public.stock_movements', 'INSERT')),
  ('app user can read products',
     has_table_privilege('cpuser_posapp', 'public.products', 'SELECT'))
) AS c(check_name, passed);