-- Pacific Logistics · slice 39 · Retire ProjectStarter grants
--
-- ProjectStarterController reads from `project_starter_tasks`, an rsflow
-- legacy table that was never migrated into Pacific. The controller was
-- seeded with grants for all 10 roles, so any user landing on
-- /ProjectStarter/myQueue (bookmarked or typed) gets a fatal PDO error
-- instead of a friendly 403.
--
-- Fix: revoke every grant on ProjectStarter. The router's permission
-- check will now block the URL before the controller runs its query,
-- and users get "You do not have permission to access this page."
--
-- If someone later ports project_starter_tasks to Pacific or writes a
-- Pacific-native replacement, add fresh grants targeted at just the
-- roles that need it.

DELETE FROM user_groups_perms
 WHERE controller_allowed = 'ProjectStarter';

SELECT 'ProjectStarter grants remaining' AS metric, COUNT(*) AS n
  FROM user_groups_perms
 WHERE controller_allowed = 'ProjectStarter';
