From a0b85e11fd5c19164d6c9e6fc09577f48d889f5c Mon Sep 17 00:00:00 2001
From: dadachann <185672915+dadachann@users.noreply.github.com>
Date: Thu, 30 Jul 2026 14:44:57 +0000
Subject: [PATCH] fix(deploy): keep runtime role schema read-only

---
 deploy/prod/deploy.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/deploy/prod/deploy.sh b/deploy/prod/deploy.sh
index 3916a2c17..fe9dd86f5 100755
--- a/deploy/prod/deploy.sh
+++ b/deploy/prod/deploy.sh
@@ -70,7 +70,8 @@ SELECT format('CREATE ROLE langbot_runtime LOGIN PASSWORD %L', :'runtime_passwor
 WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'langbot_runtime')\gexec
 ALTER ROLE langbot_runtime PASSWORD :'runtime_password';
 GRANT CONNECT ON DATABASE langbot TO langbot_runtime;
-GRANT USAGE, CREATE ON SCHEMA public TO langbot_runtime;
+REVOKE CREATE ON SCHEMA public FROM PUBLIC, langbot_runtime;
+GRANT USAGE ON SCHEMA public TO langbot_runtime;
 SQL
 
 docker compose --profile tools run --rm migrate