#!/bin/sh
set -eu

: "${ATLAS_MIGRATOR_PASSWORD:?ATLAS_MIGRATOR_PASSWORD is required}"
: "${ATLAS_APP_PASSWORD:?ATLAS_APP_PASSWORD is required}"

psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" --set ON_ERROR_STOP=1 \
  --set database_name="$POSTGRES_DB" --set migrator_password="$ATLAS_MIGRATOR_PASSWORD" --set app_password="$ATLAS_APP_PASSWORD" <<-'SQL'
  CREATE ROLE atlas_migrator LOGIN NOINHERIT NOBYPASSRLS PASSWORD :'migrator_password';
  CREATE ROLE atlas_app NOLOGIN NOINHERIT NOBYPASSRLS;
  CREATE ROLE atlas_app_login LOGIN NOINHERIT NOBYPASSRLS PASSWORD :'app_password';
  GRANT atlas_app TO atlas_app_login;
  -- 仅允许迁移角色创建 atlas schema；应用登录角色不拥有数据库级建库权限。
  GRANT CREATE ON DATABASE :"database_name" TO atlas_migrator;
  CREATE SCHEMA atlas AUTHORIZATION atlas_migrator;
  GRANT USAGE ON SCHEMA atlas TO atlas_app;
  ALTER DEFAULT PRIVILEGES FOR ROLE atlas_migrator IN SCHEMA atlas GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO atlas_app;
  ALTER DEFAULT PRIVILEGES FOR ROLE atlas_migrator IN SCHEMA atlas GRANT USAGE, SELECT ON SEQUENCES TO atlas_app;
SQL