#!/bin/sh
set -eu

read_secret() {
  value=$(cat "/run/secrets/$1")
  if [ -z "$value" ] || printf '%s' "$value" | grep -q '[[:space:]]'; then
    echo "$1 must be non-empty and contain no whitespace" >&2
    exit 2
  fi
  printf '%s' "$value"
}

migrator_password=$(read_secret vector_migrator_password)
reader_password=$(read_secret vector_reader_password)
writer_password=$(read_secret vector_writer_password)

psql --set=ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
  --set=migrator_user="$THT_VECTOR_MIGRATOR_USER" \
  --set=migrator_password="$migrator_password" \
  --set=reader_user="$THT_VECTOR_READER_USER" \
  --set=reader_password="$reader_password" \
  --set=writer_user="$THT_VECTOR_WRITER_USER" \
  --set=writer_password="$writer_password" <<'SQL'
CREATE ROLE vector_reader NOLOGIN;
CREATE ROLE vector_writer NOLOGIN;

SELECT format('CREATE ROLE %I LOGIN PASSWORD %L CREATEROLE', :'migrator_user', :'migrator_password') \gexec
SELECT format('CREATE ROLE %I LOGIN PASSWORD %L', :'reader_user', :'reader_password') \gexec
SELECT format('CREATE ROLE %I LOGIN PASSWORD %L', :'writer_user', :'writer_password') \gexec
SELECT format('GRANT vector_reader TO %I', :'reader_user') \gexec
SELECT format('GRANT vector_writer TO %I', :'writer_user') \gexec
SELECT format('ALTER DATABASE %I OWNER TO %I', current_database(), :'migrator_user') \gexec
SELECT format('CREATE SCHEMA vectors AUTHORIZATION %I', :'migrator_user') \gexec
REVOKE ALL ON SCHEMA vectors FROM PUBLIC;
CREATE EXTENSION vector WITH SCHEMA vectors;
SQL