-- goalu 逐站專屬帳號 GRANT 草稿
-- 由 tools/db-matrix/gen_grants.py 從寫入權矩陣產生，**不要手改**
-- 產生時間：見 git log；重生：sudo tools/db-matrix/rebuild.sh
--
-- 🔴 執行前必讀
--  1. 密碼用 <PASSWORD> 佔位，執行時換成真的，並同步寫進該站 .env（不要寫死在 PHP）
--  2. 一站一次、一站一 commit，降權後觀察 ≥7 天再動下一站
--  3. 別建 user@localhost 同名影子帳號（會遮蔽 wildcard 帳號）
--  4. 這是**草稿**：靜態掃描可能漏動態表名，上線前跑該站 smoke test

-- ════ 第 0 步：不動程式碼就能降風險（先做這個）════
-- david/tom 目前是 GRANT ALL ON *.* —— 整台 MariaDB 全庫可寫。先收成單庫：
REVOKE ALL PRIVILEGES, GRANT OPTION ON *.* FROM 'david'@'%';
GRANT ALL PRIVILEGES ON `goalu`.* TO 'david'@'%';
REVOKE ALL PRIVILEGES, GRANT OPTION ON *.* FROM 'tom'@'%';
GRANT ALL PRIVILEGES ON `goalu`.* TO 'tom'@'%';
-- ⚠️ david@localhost 另有 shop/starmath/skilltree 的授權，tom 另有 invoice/rotary/kn；
--    收 *.* 前先 SHOW GRANTS 確認那些單庫授權還在，否則會連帶打斷其他站。
FLUSH PRIVILEGES;

-- ════ html/report → report_app ════
-- 報表站（傳統 PHP，明碼密碼待改 env）
-- 寫 2 張表、另讀 42 張
CREATE USER IF NOT EXISTS 'report_app'@'localhost' IDENTIFIED BY '<PASSWORD>';
-- 寫入
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`ibadtrdcount` TO 'report_app'@'localhost';
GRANT SELECT, UPDATE ON `goalu`.`sys_sales` TO 'report_app'@'localhost';
-- 唯讀
GRANT SELECT ON `goalu`.`address_book_indexes` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`address_books` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`apart_comp` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`apart_sales` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`call_data` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`call_list` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`change_resources` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`customer_gs` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`customers` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`daily_dvs` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`daily_orders` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`daily_sales` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`gcust` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`gcust_dv` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_ant` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_dorder` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_dorder_rt` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_dv` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_token` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_trd` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`hum` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`i_day_qty` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`i_deadline` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`i_dv_record_copy3` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`i_prod` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`i_visit_data` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`i_visit_group` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`iexpense` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`line_chat` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`marea` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`order_records` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`pbx_call_record` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`pbx_call_transcript` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`rpt_delivery_achievement` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`rt10_list` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`sales_dvms` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`sales_report` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`sys_uemp` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`trades` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`weekly_order_items` TO 'report_app'@'localhost';
GRANT SELECT ON `goalu`.`weekly_orders` TO 'report_app'@'localhost';
-- 驗證：SHOW GRANTS FOR 'report_app'@'localhost';
--       在該站實測 SELECT 一張域外表，必須噴權限錯誤才算隔離成功

-- ════ html/sony → sony_app ════
-- 皇銘 SONY 後台（明碼密碼待改 env）
-- 寫 3 張表、另讀 0 張
CREATE USER IF NOT EXISTS 'sony_app'@'localhost' IDENTIFIED BY '<PASSWORD>';
-- 寫入
GRANT SELECT, UPDATE ON `goalu`.`sony_admin_user` TO 'sony_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`sony_line_chat` TO 'sony_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`sony_line_user` TO 'sony_app'@'localhost';
-- 驗證：SHOW GRANTS FOR 'sony_app'@'localhost';
--       在該站實測 SELECT 一張域外表，必須噴權限錯誤才算隔離成功

-- ════ kng.tw → kngtw_app ════
-- 集團入口與金流 callback（明碼密碼待改 env）
-- 寫 1 張表、另讀 2 張
CREATE USER IF NOT EXISTS 'kngtw_app'@'localhost' IDENTIFIED BY '<PASSWORD>';
-- 寫入
GRANT SELECT, UPDATE ON `goalu`.`i_form` TO 'kngtw_app'@'localhost';
-- 唯讀
GRANT SELECT ON `goalu`.`hcust` TO 'kngtw_app'@'localhost';
GRANT SELECT ON `goalu`.`i_form_track` TO 'kngtw_app'@'localhost';
-- 驗證：SHOW GRANTS FOR 'kngtw_app'@'localhost';
--       在該站實測 SELECT 一張域外表，必須噴權限錯誤才算隔離成功

-- ════ forms → forms_app ════
-- 表單站 Laravel
-- 寫 7 張表、另讀 8 張
CREATE USER IF NOT EXISTS 'forms_app'@'localhost' IDENTIFIED BY '<PASSWORD>';
-- 寫入
GRANT SELECT, INSERT ON `goalu`.`SMS_log` TO 'forms_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`hcust` TO 'forms_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`hcust_dorder` TO 'forms_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`hcust_trd` TO 'forms_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`i_form` TO 'forms_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`i_form_track` TO 'forms_app'@'localhost';
GRANT SELECT, UPDATE ON `goalu`.`rt10_list` TO 'forms_app'@'localhost';
-- 唯讀
GRANT SELECT ON `goalu`.`apart_comp` TO 'forms_app'@'localhost';
GRANT SELECT ON `goalu`.`apart_sales` TO 'forms_app'@'localhost';
GRANT SELECT ON `goalu`.`gprod` TO 'forms_app'@'localhost';
GRANT SELECT ON `goalu`.`i_deadline` TO 'forms_app'@'localhost';
GRANT SELECT ON `goalu`.`i_prod` TO 'forms_app'@'localhost';
GRANT SELECT ON `goalu`.`marea` TO 'forms_app'@'localhost';
GRANT SELECT ON `goalu`.`payment` TO 'forms_app'@'localhost';
GRANT SELECT ON `goalu`.`sys_sales` TO 'forms_app'@'localhost';
-- 驗證：SHOW GRANTS FOR 'forms_app'@'localhost';
--       在該站實測 SELECT 一張域外表，必須噴權限錯誤才算隔離成功

-- ════ inventory → inventory_app ════
-- 庫存站 Laravel（目前用 tom）
-- 寫 9 張表、另讀 8 張
CREATE USER IF NOT EXISTS 'inventory_app'@'localhost' IDENTIFIED BY '<PASSWORD>';
-- 寫入
GRANT SELECT, INSERT, DELETE ON `goalu`.`date_tags` TO 'inventory_app'@'localhost';
GRANT SELECT, UPDATE ON `goalu`.`gcust_ml` TO 'inventory_app'@'localhost';
GRANT SELECT, UPDATE ON `goalu`.`hcust` TO 'inventory_app'@'localhost';
GRANT SELECT, INSERT, DELETE ON `goalu`.`hcust_trd` TO 'inventory_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`inventory_details` TO 'inventory_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`inventory_items` TO 'inventory_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`inventory_main` TO 'inventory_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`inventory_side_products` TO 'inventory_app'@'localhost';
GRANT SELECT, INSERT, DELETE ON `goalu`.`toy_stocks` TO 'inventory_app'@'localhost';
-- 唯讀
GRANT SELECT ON `goalu`.`daily_dvs` TO 'inventory_app'@'localhost';
GRANT SELECT ON `goalu`.`daily_orders` TO 'inventory_app'@'localhost';
GRANT SELECT ON `goalu`.`gcust_ml_items` TO 'inventory_app'@'localhost';
GRANT SELECT ON `goalu`.`hum` TO 'inventory_app'@'localhost';
GRANT SELECT ON `goalu`.`i_prod` TO 'inventory_app'@'localhost';
GRANT SELECT ON `goalu`.`marea` TO 'inventory_app'@'localhost';
GRANT SELECT ON `goalu`.`procedure_performance_logs` TO 'inventory_app'@'localhost';
GRANT SELECT ON `goalu`.`sys_uemp` TO 'inventory_app'@'localhost';
-- 驗證：SHOW GRANTS FOR 'inventory_app'@'localhost';
--       在該站實測 SELECT 一張域外表，必須噴權限錯誤才算隔離成功

-- ════ story → story_app ════
-- 繪本站 Laravel（目前用 tom，幾乎不碰 goalu）
-- 寫 0 張表、另讀 1 張
CREATE USER IF NOT EXISTS 'story_app'@'localhost' IDENTIFIED BY '<PASSWORD>';
-- 唯讀
GRANT SELECT ON `goalu`.`pbx_call_record` TO 'story_app'@'localhost';
-- 驗證：SHOW GRANTS FOR 'story_app'@'localhost';
--       在該站實測 SELECT 一張域外表，必須噴權限錯誤才算隔離成功

-- ════ pbx → pbx_app ════
-- PBX 站 Laravel
-- 寫 1 張表、另讀 4 張
CREATE USER IF NOT EXISTS 'pbx_app'@'localhost' IDENTIFIED BY '<PASSWORD>';
-- 寫入
GRANT SELECT, INSERT, UPDATE ON `goalu`.`pbx_call_record` TO 'pbx_app'@'localhost';
-- 唯讀
GRANT SELECT ON `goalu`.`customers` TO 'pbx_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust` TO 'pbx_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_trd` TO 'pbx_app'@'localhost';
GRANT SELECT ON `goalu`.`pbx_token` TO 'pbx_app'@'localhost';
-- 驗證：SHOW GRANTS FOR 'pbx_app'@'localhost';
--       在該站實測 SELECT 一張域外表，必須噴權限錯誤才算隔離成功

-- ════ pbx-laravel12 → pbx12_app ════
-- PBX Laravel 12 版
-- 寫 1 張表、另讀 4 張
CREATE USER IF NOT EXISTS 'pbx12_app'@'localhost' IDENTIFIED BY '<PASSWORD>';
-- 寫入
GRANT SELECT, INSERT, UPDATE ON `goalu`.`pbx_call_record` TO 'pbx12_app'@'localhost';
-- 唯讀
GRANT SELECT ON `goalu`.`customers` TO 'pbx12_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust` TO 'pbx12_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_trd` TO 'pbx12_app'@'localhost';
GRANT SELECT ON `goalu`.`pbx_token` TO 'pbx12_app'@'localhost';
-- 驗證：SHOW GRANTS FOR 'pbx12_app'@'localhost';
--       在該站實測 SELECT 一張域外表，必須噴權限錯誤才算隔離成功

-- ════ delivery → delivery_app ════
-- 配送站 Laravel
-- 寫 2 張表、另讀 6 張
CREATE USER IF NOT EXISTS 'delivery_app'@'localhost' IDENTIFIED BY '<PASSWORD>';
-- 寫入
GRANT SELECT, INSERT, UPDATE ON `goalu`.`delivery_list` TO 'delivery_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`hcust` TO 'delivery_app'@'localhost';
-- 唯讀
GRANT SELECT ON `goalu`.`address_book_indexes` TO 'delivery_app'@'localhost';
GRANT SELECT ON `goalu`.`customers` TO 'delivery_app'@'localhost';
GRANT SELECT ON `goalu`.`dv_covers` TO 'delivery_app'@'localhost';
GRANT SELECT ON `goalu`.`marea` TO 'delivery_app'@'localhost';
GRANT SELECT ON `goalu`.`sys_sales` TO 'delivery_app'@'localhost';
GRANT SELECT ON `goalu`.`sys_uemp` TO 'delivery_app'@'localhost';
-- 驗證：SHOW GRANTS FOR 'delivery_app'@'localhost';
--       在該站實測 SELECT 一張域外表，必須噴權限錯誤才算隔離成功

-- ════ line → line_app ════
-- LINE 站 Laravel
-- 寫 11 張表、另讀 20 張
CREATE USER IF NOT EXISTS 'line_app'@'localhost' IDENTIFIED BY '<PASSWORD>';
-- 寫入
GRANT SELECT, INSERT ON `goalu`.`address_book_indexes` TO 'line_app'@'localhost';
GRANT SELECT, UPDATE ON `goalu`.`bug_reports` TO 'line_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`customers` TO 'line_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`hcust_token` TO 'line_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`i_form` TO 'line_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`line_chat` TO 'line_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`line_group_link` TO 'line_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`line_menu_clicks` TO 'line_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`line_unfollow` TO 'line_app'@'localhost';
GRANT SELECT, INSERT, DELETE ON `goalu`.`line_unlogin_assign` TO 'line_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`payment` TO 'line_app'@'localhost';
-- 唯讀
GRANT SELECT ON `goalu`.`address_books` TO 'line_app'@'localhost';
GRANT SELECT ON `goalu`.`cub_rcv` TO 'line_app'@'localhost';
GRANT SELECT ON `goalu`.`daily_orders` TO 'line_app'@'localhost';
GRANT SELECT ON `goalu`.`gprod` TO 'line_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust` TO 'line_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_amt_rcv` TO 'line_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_ant` TO 'line_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_dv` TO 'line_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_qtyf` TO 'line_app'@'localhost';
GRANT SELECT ON `goalu`.`i_deadline` TO 'line_app'@'localhost';
GRANT SELECT ON `goalu`.`i_prod` TO 'line_app'@'localhost';
GRANT SELECT ON `goalu`.`invoice_details` TO 'line_app'@'localhost';
GRANT SELECT ON `goalu`.`invoices` TO 'line_app'@'localhost';
GRANT SELECT ON `goalu`.`line_unlogin_list` TO 'line_app'@'localhost';
GRANT SELECT ON `goalu`.`marea` TO 'line_app'@'localhost';
GRANT SELECT ON `goalu`.`posting_log` TO 'line_app'@'localhost';
GRANT SELECT ON `goalu`.`sys_uemp` TO 'line_app'@'localhost';
GRANT SELECT ON `goalu`.`trades` TO 'line_app'@'localhost';
GRANT SELECT ON `goalu`.`weekly_order_items` TO 'line_app'@'localhost';
GRANT SELECT ON `goalu`.`weekly_orders` TO 'line_app'@'localhost';
-- 驗證：SHOW GRANTS FOR 'line_app'@'localhost';
--       在該站實測 SELECT 一張域外表，必須噴權限錯誤才算隔離成功

-- ════ invoice → invoice_app ════
-- 發票站 Laravel
-- 寫 17 張表、另讀 28 張
CREATE USER IF NOT EXISTS 'invoice_app'@'localhost' IDENTIFIED BY '<PASSWORD>';
-- 寫入
GRANT SELECT, INSERT, UPDATE ON `goalu`.`SMS_log` TO 'invoice_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`apart_comp` TO 'invoice_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`apart_sales` TO 'invoice_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`call_empty` TO 'invoice_app'@'localhost';
GRANT SELECT, UPDATE ON `goalu`.`gcust_ant` TO 'invoice_app'@'localhost';
GRANT SELECT, UPDATE ON `goalu`.`hcust_ant` TO 'invoice_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`hcust_trd` TO 'invoice_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`hum` TO 'invoice_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`hum_con` TO 'invoice_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`hum_nrdd` TO 'invoice_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`hum_rel` TO 'invoice_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`i_deadline` TO 'invoice_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`iexpense` TO 'invoice_app'@'localhost';
GRANT SELECT, INSERT, DELETE ON `goalu`.`invoice_details` TO 'invoice_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`invoices` TO 'invoice_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`sys_sales` TO 'invoice_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`sys_uemp` TO 'invoice_app'@'localhost';
-- 唯讀
GRANT SELECT ON `goalu`.`address_book_indexes` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`call_data` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`call_list` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`customer_gs` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`customer_pms` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`customer_price_details` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`customer_prices` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`customers` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`daily_orders` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`dv_orders` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`gcust` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`gcust_dv` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`gcust_price` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`gprod` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_amt_pre` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_amt_rcv` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_dorder` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_qtyf` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`hum_special_off` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`hum_wktime` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`i_prod` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`i_sales_car` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`i_sales_daily` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`marea` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`pbx_call_record` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`sys_pm` TO 'invoice_app'@'localhost';
GRANT SELECT ON `goalu`.`trades` TO 'invoice_app'@'localhost';
-- 驗證：SHOW GRANTS FOR 'invoice_app'@'localhost';
--       在該站實測 SELECT 一張域外表，必須噴權限錯誤才算隔離成功

-- ════ html/sales → sales_app ════
-- 業務站（傳統 PHP，明碼密碼待改 env）
-- 寫 6 張表、另讀 11 張
CREATE USER IF NOT EXISTS 'sales_app'@'localhost' IDENTIFIED BY '<PASSWORD>';
-- 寫入
GRANT SELECT, INSERT, UPDATE ON `goalu`.`hcust` TO 'sales_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`hcust_dorder` TO 'sales_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`hcust_trd` TO 'sales_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`i_visit_data` TO 'sales_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`i_visit_group` TO 'sales_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`payment` TO 'sales_app'@'localhost';
-- 唯讀
GRANT SELECT ON `goalu`.`apart_comp` TO 'sales_app'@'localhost';
GRANT SELECT ON `goalu`.`apart_sales` TO 'sales_app'@'localhost';
GRANT SELECT ON `goalu`.`gprod` TO 'sales_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_ant` TO 'sales_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_dorder_rt` TO 'sales_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_dv` TO 'sales_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_qtyf` TO 'sales_app'@'localhost';
GRANT SELECT ON `goalu`.`i_deadline` TO 'sales_app'@'localhost';
GRANT SELECT ON `goalu`.`sales_report` TO 'sales_app'@'localhost';
GRANT SELECT ON `goalu`.`sys_sales` TO 'sales_app'@'localhost';
GRANT SELECT ON `goalu`.`sys_uemp` TO 'sales_app'@'localhost';
-- 驗證：SHOW GRANTS FOR 'sales_app'@'localhost';
--       在該站實測 SELECT 一張域外表，必須噴權限錯誤才算隔離成功

-- ════ www.kngoatmilk.com → www_app ════
-- 官網與對外 API
-- 寫 11 張表、另讀 17 張
CREATE USER IF NOT EXISTS 'www_app'@'localhost' IDENTIFIED BY '<PASSWORD>';
-- 寫入
GRANT SELECT, INSERT, UPDATE ON `goalu`.`SMS_log` TO 'www_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`hcust` TO 'www_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`hcust_dorder` TO 'www_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`hcust_token` TO 'www_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`hcust_trd` TO 'www_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`i_form` TO 'www_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`i_form_track` TO 'www_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`line_chat` TO 'www_app'@'localhost';
GRANT SELECT, UPDATE ON `goalu`.`message_logs` TO 'www_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`payment` TO 'www_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`trades` TO 'www_app'@'localhost';
-- 唯讀
GRANT SELECT ON `goalu`.`address_book_indexes` TO 'www_app'@'localhost';
GRANT SELECT ON `goalu`.`address_books` TO 'www_app'@'localhost';
GRANT SELECT ON `goalu`.`cub_rcv` TO 'www_app'@'localhost';
GRANT SELECT ON `goalu`.`customers` TO 'www_app'@'localhost';
GRANT SELECT ON `goalu`.`daily_orders` TO 'www_app'@'localhost';
GRANT SELECT ON `goalu`.`gcust` TO 'www_app'@'localhost';
GRANT SELECT ON `goalu`.`gcust_cls` TO 'www_app'@'localhost';
GRANT SELECT ON `goalu`.`gcust_dorder` TO 'www_app'@'localhost';
GRANT SELECT ON `goalu`.`gprod` TO 'www_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_amt_pre` TO 'www_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_ant` TO 'www_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_dv` TO 'www_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_qtyf` TO 'www_app'@'localhost';
GRANT SELECT ON `goalu`.`i_deadline` TO 'www_app'@'localhost';
GRANT SELECT ON `goalu`.`i_prod` TO 'www_app'@'localhost';
GRANT SELECT ON `goalu`.`i_rv_tp_area` TO 'www_app'@'localhost';
GRANT SELECT ON `goalu`.`marea` TO 'www_app'@'localhost';
-- 驗證：SHOW GRANTS FOR 'www_app'@'localhost';
--       在該站實測 SELECT 一張域外表，必須噴權限錯誤才算隔離成功

-- ════ ERP(kngoatmilk) → erp_app ════
-- 舊 ERP——應為多數業務表的唯一 writer，最後拆
-- 寫 63 張表、另讀 29 張
CREATE USER IF NOT EXISTS 'erp_app'@'localhost' IDENTIFIED BY '<PASSWORD>';
-- 寫入
GRANT SELECT, UPDATE, DELETE ON `goalu`.`address_book_indexes` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, DELETE ON `goalu`.`address_books` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`change_resources` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`contacts` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`cron_alerts` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`cub_rcv` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`cub_record` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`customer_evens` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, DELETE ON `goalu`.`customer_pms` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`customer_pre_jobs` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`customer_price_details` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`customer_price_templates` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`customer_prices` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`customers` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`daily_dvs` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`daily_gprod_jobs` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, DELETE ON `goalu`.`daily_gprods` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`daily_orders` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`dv_covers` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`dv_dvms` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`dv_orders` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`element_events` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`estimate_runs` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`gcust` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`gcust_ant` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`gcust_cls` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`gcust_dorder` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`gcust_dv` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`gcust_even` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`gcust_ml` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`gcust_mu` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`gcust_narea_ant` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`gcust_price` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`gcust_price_classes` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`gcust_trd` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`gprod` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`hcust` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`hcust_amt_pre` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`hcust_amt_rcv` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`hcust_ant` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`hcust_ant_mk` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`hcust_dorder` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`hcust_dv` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`hcust_even` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`hcust_qtyf` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`hcust_trd` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`hcust_trd_del` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`hcust_trd_rt` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`i_credit_qtyf` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`i_deadline` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`i_dvm_yn` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, DELETE ON `goalu`.`i_prod_no_dvs` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, DELETE ON `goalu`.`invoices` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`marea` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`marea_covers` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`order_records` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`price_templates` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`sales_dept_performance_targets` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`sales_hcust_qty` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`sys_pm` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`tasks` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`trades` TO 'erp_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`weekly_orders` TO 'erp_app'@'localhost';
-- 唯讀
GRANT SELECT ON `goalu`.`SMS_log` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`audits` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`customer_gs` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`customer_hs` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`daily_orders_shadow` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`dv_orders_shadow` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`dv_unit_price` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`gcust_close` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`gcust_ml_items` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_close` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_token` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`hum` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`i_day_qty` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`i_prod` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`i_rv_tp_area` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`i_steambox_pos` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`invoice_details` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`jobs` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`line_chat` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`line_group_link` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`marea_cover_details` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`message_logs` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`posting_log` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`sales_dvm_products` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`sales_dvms` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`sys_sales` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`sys_uemp` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`task_results` TO 'erp_app'@'localhost';
GRANT SELECT ON `goalu`.`weekly_order_items` TO 'erp_app'@'localhost';
-- 驗證：SHOW GRANTS FOR 'erp_app'@'localhost';
--       在該站實測 SELECT 一張域外表，必須噴權限錯誤才算隔離成功

-- ════ html/salary → salary_legacy_app ════
-- 總務室本體，87 張表寫入。不一次拆，隨階段 5 逐模組搬
-- 寫 87 張表、另讀 45 張
CREATE USER IF NOT EXISTS 'salary_legacy_app'@'localhost' IDENTIFIED BY '<PASSWORD>';
-- 寫入
GRANT SELECT, INSERT ON `goalu`.`SMS_log` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, UPDATE, DELETE ON `goalu`.`address_book_indexes` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, UPDATE, DELETE ON `goalu`.`address_books` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`apart_sales` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, DELETE ON `goalu`.`birthday_card_done` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`bug_reports` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, UPDATE ON `goalu`.`call_data` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, DELETE ON `goalu`.`call_empty` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`call_empty_auto` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`change_resources` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, DELETE ON `goalu`.`contacts` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`cron_alerts` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`cron_job_logs` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`cron_jobs` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`cron_permission_snapshots` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`cub_estimate` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`cub_rcv` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`cub_record` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, DELETE ON `goalu`.`customer_evens` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, DELETE, DROP ON `goalu`.`customer_phone_index` TO 'salary_legacy_app'@'localhost';   -- ⚠️ DROP 是 TRUNCATE 需要的，確認真的在用再給
GRANT SELECT, INSERT ON `goalu`.`customer_price_details` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`customer_prices` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, UPDATE, DELETE ON `goalu`.`customers` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`customers_gps` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, DELETE ON `goalu`.`daily_orders` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, DELETE ON `goalu`.`dv_orders` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`fax_print_log` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`fax_rotation` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, UPDATE ON `goalu`.`gcust` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, UPDATE ON `goalu`.`gcust_ant` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`gcust_ant_single` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`gcust_atm_posted` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`gcust_cls` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`gcust_narea_idno` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`hcust` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, DELETE ON `goalu`.`hcust_token` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`hcust_token_archive` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`hcust_trd` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, UPDATE ON `goalu`.`hum` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, DELETE ON `goalu`.`hum_related_cust` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`hum_wktime` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`i_form` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, DELETE ON `goalu`.`i_send_msg` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, DELETE ON `goalu`.`i_steambox_pos` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`i_visit_data` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`i_visit_group` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`invoice_details` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`invoices` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`line_chat` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`line_chat_auto_reply_log` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`line_chat_summary` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, DELETE ON `goalu`.`line_cs_quality_cases` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`line_cs_quality_jobs` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`line_group_link` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, DELETE ON `goalu`.`line_notice` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, DROP ON `goalu`.`line_unlogin_list` TO 'salary_legacy_app'@'localhost';   -- ⚠️ DROP 是 TRUNCATE 需要的，確認真的在用再給
GRANT SELECT, UPDATE ON `goalu`.`marea` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`message_logs` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`net_perf_ad_spend` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, UPDATE ON `goalu`.`net_perf_config` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`net_perf_settlement` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`notes` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, DELETE ON `goalu`.`oldprice40_review_notes` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, DELETE ON `goalu`.`order_records` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`orders_form_other` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`page_daily_access` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`page_info` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`payment` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`payment_attempts` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`payment_callback_failures` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`pbx_call_record` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, UPDATE ON `goalu`.`pbx_call_transcript` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, DELETE ON `goalu`.`punch_hum_anyip` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`renewal_sms_log` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, UPDATE ON `goalu`.`rt10_list` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`salary2txt_log` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`sony_line_chat` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE ON `goalu`.`sony_line_user` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT ON `goalu`.`sor_config` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, DELETE ON `goalu`.`sor_extra` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, DELETE ON `goalu`.`sor_maintain_school` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, UPDATE ON `goalu`.`sor_price` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE, DROP ON `goalu`.`sys_sidebar_menu` TO 'salary_legacy_app'@'localhost';   -- ⚠️ DROP 是 TRUNCATE 需要的，確認真的在用再給
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`trades` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, DELETE ON `goalu`.`weekly_order_items` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, UPDATE, DELETE ON `goalu`.`weekly_orders` TO 'salary_legacy_app'@'localhost';
GRANT SELECT, INSERT, UPDATE, DELETE ON `goalu`.`youtube_summaries` TO 'salary_legacy_app'@'localhost';
-- 唯讀
GRANT SELECT ON `goalu`.`ai_assets` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`ai_jobs` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`apart_comp` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`call_list` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`customer_gs` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`customer_hs` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`customer_pms` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`delivery_list` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`dv_covers` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`dv_dvms` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`dv_unit_price` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`gcust_dorder` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`gcust_dv` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`gcust_ml` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`gcust_ml_items` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`gcust_mu` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`gcust_trd` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`gprod` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`gpu_jobs` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_amt_pre` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_amt_rcv` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_ant` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_dorder` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_dv` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`hcust_qtyf` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`hum_con` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`hum_msar` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`hum_nrdd` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`i_deadline` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`i_dv_record_copy3` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`i_dvm_yn` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`i_form_track` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`i_prod` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`i_rv_tp_area` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`inventory_details` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`inventory_items` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`inventory_main` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`line_menu_clicks` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`line_unfollow` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`line_unlogin_assign` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`oldprice40_charged_cache` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`rpt_delivery_achievement` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`sys_pm` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`sys_sales` TO 'salary_legacy_app'@'localhost';
GRANT SELECT ON `goalu`.`sys_uemp` TO 'salary_legacy_app'@'localhost';
-- 驗證：SHOW GRANTS FOR 'salary_legacy_app'@'localhost';
--       在該站實測 SELECT 一張域外表，必須噴權限錯誤才算隔離成功

