#!/usr/bin/env bash
# Runs once, when the fuel-db volume is first initialised (mounted after the
# image's own TimescaleDB scripts, as 010_petrolyst_roles.sh).
#   fuel_owner  owns database "fuel", its public schema and every table in it.
#               Loaders log in as their own role but act as fuel_owner (README
#               "Data loaders"): the default privileges below cover only what
#               fuel_owner itself creates, not what its members create.
#   trino_ro    what Trino connects as: read-only, also on tables created later.
set -euo pipefail

trino_password=$(cat /run/secrets/fuel_db_trino_password)

psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
  -v trino_password="$trino_password" <<'SQL'
CREATE ROLE fuel_owner NOLOGIN;
ALTER DATABASE fuel OWNER TO fuel_owner;
REVOKE CREATE ON SCHEMA public FROM PUBLIC;

CREATE ROLE trino_ro LOGIN PASSWORD :'trino_password';
GRANT CONNECT ON DATABASE fuel TO trino_ro;
GRANT USAGE ON SCHEMA public TO trino_ro;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO trino_ro;
ALTER DEFAULT PRIVILEGES FOR ROLE fuel_owner IN SCHEMA public
  GRANT SELECT ON TABLES TO trino_ro;
SQL