-- Idempotent role and database creation for blackbeard.observer.
--
-- Run once, by an operator, on the Postgres PRIMARY only (magrathea) —
-- replication carries roles and databases to the standby. Applied by
-- script/infra-setup.sh --database.
--
-- No password is set on the role, deliberately and permanently. Authentication
-- is mTLS: the app host's certificate CN maps to this role through a
-- pg_ident.conf drop-in, which infra-setup.sh installs on BOTH servers. A
-- standby missing that mapping locks the app out on failover
-- (architecture/generic.md §5).

do $$
begin
  if not exists (select from pg_roles where rolname = 'blackbeard_rw') then
    create role blackbeard_rw with login;
  end if;
  -- A read-only role for ad-hoc queries and any future reporting, so nothing
  -- has to borrow the writer's credentials to look at the data.
  if not exists (select from pg_roles where rolname = 'blackbeard_ro') then
    create role blackbeard_ro with login;
  end if;
end
$$;

-- `create database` cannot run inside a transaction block or a DO block, so the
-- caller guards it: infra-setup.sh checks first and skips if present.

\connect blackbeard

-- The writer owns the schema so sqlx migrations can create tables.
alter schema public owner to blackbeard_rw;
grant usage on schema public to blackbeard_ro;

-- Applies to tables the migrations have not created yet, so a new migration
-- does not need this file re-run.
alter default privileges for role blackbeard_rw in schema public
  grant select on tables to blackbeard_ro;
grant select on all tables in schema public to blackbeard_ro;