\
#!/usr/bin/env bash
set -Eeuo pipefail

: "${POSTGRES_USER:?}"
: "${POSTGRES_DB:?}"
: "${APP_DB_USER:?}"
: "${APP_DB_PASSWORD:?}"

psql -v ON_ERROR_STOP=1 \
  --username "$POSTGRES_USER" \
  --dbname "$POSTGRES_DB" <<EOSQL
CREATE EXTENSION IF NOT EXISTS postgis;
CREATE EXTENSION IF NOT EXISTS pgcrypto;

DO \$\$
BEGIN
  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${APP_DB_USER}') THEN
    EXECUTE format(
      'CREATE ROLE %I LOGIN PASSWORD %L NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION',
      '${APP_DB_USER}',
      '${APP_DB_PASSWORD}'
    );
  END IF;
END
\$\$;

GRANT CONNECT ON DATABASE "${POSTGRES_DB}" TO "${APP_DB_USER}";
GRANT USAGE ON SCHEMA public TO "${APP_DB_USER}";
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO "${APP_DB_USER}";
GRANT USAGE, SELECT, UPDATE ON ALL SEQUENCES IN SCHEMA public TO "${APP_DB_USER}";

ALTER DEFAULT PRIVILEGES FOR USER "${POSTGRES_USER}" IN SCHEMA public
GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO "${APP_DB_USER}";

ALTER DEFAULT PRIVILEGES FOR USER "${POSTGRES_USER}" IN SCHEMA public
GRANT USAGE, SELECT, UPDATE ON SEQUENCES TO "${APP_DB_USER}";
EOSQL