-- Run once as a SQL administrator. This is intentionally not a runtime script.
-- Replace every ALL_CAPS value before execution; do not commit the filled copy.
-- This recipe assumes durabletask-mssql's default TaskHubMode=1.
-- In that mode USER_NAME() is the TaskHub, so each unrelated app needs its own user.

USE [DURABLETASK_DATABASE];
GO

CREATE LOGIN [INGESTION_RUNTIME] WITH PASSWORD = 'REPLACE_WITH_A_MANAGED_SECRET';
GO
CREATE USER [INGESTION_RUNTIME] FOR LOGIN [INGESTION_RUNTIME];
GO
ALTER ROLE [dt_runtime] ADD MEMBER [INGESTION_RUNTIME];
GO

CREATE LOGIN [ENRICHMENT_RUNTIME] WITH PASSWORD = 'REPLACE_WITH_A_MANAGED_SECRET';
GO
CREATE USER [ENRICHMENT_RUNTIME] FOR LOGIN [ENRICHMENT_RUNTIME];
GO
ALTER ROLE [dt_runtime] ADD MEMBER [ENRICHMENT_RUNTIME];
GO

-- Do not grant db_owner or DDL permissions to these runtime users.
