#!/bin/sh
# First start of the Postgres container only (docker-entrypoint-initdb.d):
# the API's own ordinary role, owning its database. The API must not
# connect as the superuser — a superuser bypasses row-level security, which
# is what keeps each tenant's rows to itself (db/schema.sql).
set -e
psql -v ON_ERROR_STOP=1 -v app_password="$APP_DB_PASSWORD" --username "$POSTGRES_USER" --dbname postgres <<'SQL'
CREATE ROLE flowfabric LOGIN PASSWORD :'app_password';
CREATE DATABASE flowfabric OWNER flowfabric;
SQL