#!/usr/bin/env bash
# Runs once, when the fuel-db volume is first initialised (mounted after the
# image's own TimescaleDB scripts, as 010_petrolyst_roles.sh).
#   fuel_owner  owns database "fuel", its public schema and every table in it.
#               Loaders log in as their own role but act as fuel_owner (README
#               "Data loaders"): the default privileges below cover only what
#               fuel_owner itself creates, not what its members create.
#   fuel_ro     what Superset and the Petrolyst server read as: SELECT on public,
#               also on tables created later. Read-only by default as well: a
#               second lock behind the grants.
set -euo pipefail

ro_password=$(cat /run/secrets/fuel_db_ro_password)

psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
  -v ro_password="$ro_password" <<'SQL'
CREATE ROLE fuel_owner NOLOGIN;
ALTER DATABASE fuel OWNER TO fuel_owner;
REVOKE CREATE ON SCHEMA public FROM PUBLIC;

CREATE ROLE fuel_ro LOGIN PASSWORD :'ro_password';
ALTER ROLE fuel_ro SET default_transaction_read_only = on;
GRANT CONNECT ON DATABASE fuel TO fuel_ro;
GRANT USAGE ON SCHEMA public TO fuel_ro;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO fuel_ro;
ALTER DEFAULT PRIVILEGES FOR ROLE fuel_owner IN SCHEMA public
  GRANT SELECT ON TABLES TO fuel_ro;
SQL