#!/bin/sh
set -eu

# 只在官方镜像首次初始化空数据卷时执行。psql 引用变量，密码不进入 SQL 字面拼接或输出。
: "${DOODLE_MIGRATOR_PASSWORD:?缺少迁移账号密码}"
: "${DOODLE_APP_PASSWORD:?缺少应用账号密码}"
psql --username "$POSTGRES_USER" --dbname postgres --set ON_ERROR_STOP=1 <<'SQL'
\getenv migration_password DOODLE_MIGRATOR_PASSWORD
\getenv application_password DOODLE_APP_PASSWORD
CREATE ROLE doodle_migrator LOGIN PASSWORD :'migration_password' NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION;
CREATE ROLE doodle_app LOGIN PASSWORD :'application_password' NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION;
CREATE DATABASE doodle_prod OWNER doodle_migrator ENCODING 'UTF8' LC_COLLATE 'C' LC_CTYPE 'C' TEMPLATE template0;
REVOKE ALL ON DATABASE doodle_prod FROM PUBLIC;
GRANT CONNECT ON DATABASE doodle_prod TO doodle_migrator, doodle_app;
\connect doodle_prod
REVOKE ALL ON SCHEMA public FROM PUBLIC;
GRANT USAGE ON SCHEMA public TO doodle_app;
-- 迁移由 doodle_migrator 执行：后续创建的表自动赋予应用 DML 权限，不授予建表或删表权限。
ALTER DEFAULT PRIVILEGES FOR ROLE doodle_migrator IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO doodle_app;
ALTER DEFAULT PRIVILEGES FOR ROLE doodle_migrator IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO doodle_app;
REVOKE ALL ON DATABASE postgres FROM PUBLIC;
SQL