#!/bin/sh
# Runs once, when the Postgres volume is first initialised. Creates one login role per service;
# table grants are applied by `migrate` (packages/catalog-db/src/grants.ts).
set -eu
psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
  -v sync_pw="$SYNC_DB_PASSWORD" -v api_pw="$API_DB_PASSWORD" -v server_pw="$SERVER_DB_PASSWORD" <<'SQL'
CREATE ROLE mcp_sync   LOGIN PASSWORD :'sync_pw';
CREATE ROLE mcp_api    LOGIN PASSWORD :'api_pw';
CREATE ROLE mcp_server LOGIN PASSWORD :'server_pw';
REVOKE ALL ON SCHEMA public FROM PUBLIC;
GRANT USAGE ON SCHEMA public TO mcp_sync, mcp_api, mcp_server;
SQL