-- 01_roles.sql: cluster-level roles. Run as a superuser (postgres). Idempotent.
-- In prod: needs `sudo docker exec -i <pg-container> psql -U postgres`; set passwords separately (\password), never in this file.
DO $$
BEGIN
  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'personal_app') THEN
    CREATE ROLE personal_app LOGIN;            -- app, ned-collector, house worker
  END IF;
  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'personal_ddl') THEN
    CREATE ROLE personal_ddl NOLOGIN;          -- owns schema lists; only reachable via SECURITY DEFINER fns
  END IF;
  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'personal_ro') THEN
    CREATE ROLE personal_ro LOGIN;             -- read-only for audits/agents/pgAdmin
  END IF;
END $$;
ALTER ROLE personal_ro SET default_transaction_read_only = on;
ALTER ROLE personal_app SET search_path = '$user';   -- force schema-qualified names in app SQL
ALTER ROLE personal_ro  SET search_path = '$user';