-- PANELS · Postgres · Fase 0 (aprovisionamiento de roles)
--
-- Crea los 6 roles cluster-wide usados por PANELS: dos por módulo
-- (platform, iam, core), un rol "_owner" para Liquibase/migraciones y un
-- rol "_app" para runtime con privilegios acotados a su esquema/base.
--
-- Idempotente vía el idiom \gexec (solo emite el CREATE ROLE si todavía
-- no existe). Nota: la interpolación de variables de psql (:'var') NO
-- funciona dentro de bloques DO $$...$$ (dollar-quoting), por eso este
-- script arma el DDL con format(...)+\gexec en vez de un DO block.
--
-- Uso (contra un Postgres nuevo, como superuser/admin de Coolify). Los
-- valores se pasan SIN comillas propias; :'var' ya produce un literal SQL
-- correctamente escapado:
--   psql "$SUPERUSER_URL" \
--     -v platform_owner_pw="CAMBIA-ESTA-CLAVE-1" \
--     -v platform_app_pw="CAMBIA-ESTA-CLAVE-2" \
--     -v iam_owner_pw="CAMBIA-ESTA-CLAVE-3" \
--     -v iam_app_pw="CAMBIA-ESTA-CLAVE-4" \
--     -v core_owner_pw="CAMBIA-ESTA-CLAVE-5" \
--     -v core_app_pw="CAMBIA-ESTA-CLAVE-6" \
--     -f 01-roles.sql
--
-- Genera claves fuertes por ambiente con: openssl rand -hex 24

SELECT format('CREATE ROLE panels_platform_owner LOGIN PASSWORD %L NOSUPERUSER NOCREATEDB NOCREATEROLE', :'platform_owner_pw')
WHERE NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'panels_platform_owner')\gexec

SELECT format('CREATE ROLE panels_platform_app LOGIN PASSWORD %L NOSUPERUSER NOCREATEDB NOCREATEROLE', :'platform_app_pw')
WHERE NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'panels_platform_app')\gexec

SELECT format('CREATE ROLE panels_iam_owner LOGIN PASSWORD %L NOSUPERUSER NOCREATEDB NOCREATEROLE', :'iam_owner_pw')
WHERE NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'panels_iam_owner')\gexec

SELECT format('CREATE ROLE panels_iam_app LOGIN PASSWORD %L NOSUPERUSER NOCREATEDB NOCREATEROLE', :'iam_app_pw')
WHERE NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'panels_iam_app')\gexec

SELECT format('CREATE ROLE panels_core_owner LOGIN PASSWORD %L NOSUPERUSER NOCREATEDB NOCREATEROLE', :'core_owner_pw')
WHERE NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'panels_core_owner')\gexec

SELECT format('CREATE ROLE panels_core_app LOGIN PASSWORD %L NOSUPERUSER NOCREATEDB NOCREATEROLE', :'core_app_pw')
WHERE NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'panels_core_app')\gexec

-- Si el rol ya existía de una corrida anterior, refresca su password al
-- valor actual (para poder rotar credenciales corriendo este script de nuevo).
ALTER ROLE panels_platform_owner PASSWORD :'platform_owner_pw';
ALTER ROLE panels_platform_app PASSWORD :'platform_app_pw';
ALTER ROLE panels_iam_owner PASSWORD :'iam_owner_pw';
ALTER ROLE panels_iam_app PASSWORD :'iam_app_pw';
ALTER ROLE panels_core_owner PASSWORD :'core_owner_pw';
ALTER ROLE panels_core_app PASSWORD :'core_app_pw';