-- ThothII — ruolo vector read+write (schema vectors).
-- Stessa istanza del DWH (porta 5438). ThothII indicizza (write) + ricerca (read) direttamente.
-- La separazione reader/writer resta rilevante solo per il path REST (non usato in Profile A).
--   psql -h localhost -p 5438 -U postgres -d postgres -v PWD='<secret>' -f 20-vector-roles.sql
DO $$
BEGIN
  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'thoth_vector_rw') THEN
    CREATE ROLE thoth_vector_rw LOGIN;
  END IF;
END $$;
-- :'PWD' va fuori dal DO (psql non interpola nelle stringhe dollar-quoted)
ALTER ROLE thoth_vector_rw PASSWORD :'PWD';

CREATE SCHEMA IF NOT EXISTS vectors;

-- L'estensione pgvector deve esistere (già presente nell'istanza di produzione).
-- CREATE EXTENSION IF NOT EXISTS vector;

GRANT USAGE, CREATE ON SCHEMA vectors TO thoth_vector_rw;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA vectors TO thoth_vector_rw;
GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA vectors TO thoth_vector_rw;
ALTER DEFAULT PRIVILEGES IN SCHEMA vectors
  GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO thoth_vector_rw;
ALTER DEFAULT PRIVILEGES IN SCHEMA vectors
  GRANT USAGE, SELECT ON SEQUENCES TO thoth_vector_rw;