#!/bin/sh
set -eu

: "${POSTGRES_USER:?POSTGRES_USER is required}"
: "${POSTGRES_DB:?POSTGRES_DB is required}"
: "${POSTGRES_RUNTIME_USER:?POSTGRES_RUNTIME_USER is required}"

psql --set=ON_ERROR_STOP=1 --host=postgres --username "$POSTGRES_USER" \
  --dbname "$POSTGRES_DB" --set=runtime_user="$POSTGRES_RUNTIME_USER" <<'SQL'
SELECT format('GRANT USAGE ON SCHEMA public TO %I', :'runtime_user') \gexec
SELECT format(
  'GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO %I',
  :'runtime_user'
) \gexec
SELECT format(
  'GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO %I',
  :'runtime_user'
) \gexec
SELECT format('REVOKE UPDATE, DELETE, TRUNCATE ON audit_events FROM %I', :'runtime_user') \gexec
SELECT format('REVOKE UPDATE, DELETE, TRUNCATE ON login_events FROM %I', :'runtime_user') \gexec
SELECT format('REVOKE ALL ON alembic_version FROM %I', :'runtime_user') \gexec
SELECT format('GRANT SELECT ON alembic_version TO %I', :'runtime_user') \gexec
SQL