-- Gebos Postgres bootstrap.
-- Runs once via services.postgresql.initialScript on db-host.
--
-- Sets up:
--   * Extensions Supabase + TimescaleDB need
--   * Supabase's expected schemas and admin roles
--   * The gebos_ingest role (BYPASSRLS) used by the MQTT ingester
--   * A telemetry hypertable with tenant_id column for RLS
--
-- TODO: split into ordered files once it grows. For the skeleton, one file is fine.

create extension if not exists timescaledb;
create extension if not exists pgcrypto;
create extension if not exists pgjwt;
create extension if not exists pg_graphql;
create extension if not exists pgsodium;
-- create extension if not exists supabase_vault;   -- TODO: vendor or package

-- Supabase schemas
create schema if not exists auth;
create schema if not exists storage;
create schema if not exists _analytics;
create schema if not exists _supavisor;

-- Roles Supabase services connect as. Passwords come from secrets.env, not here.
do $$ begin
  create role anon nologin noinherit;
exception when duplicate_object then null; end $$;

do $$ begin
  create role authenticated nologin noinherit;
exception when duplicate_object then null; end $$;

do $$ begin
  create role service_role nologin noinherit bypassrls;
exception when duplicate_object then null; end $$;

do $$ begin
  create role authenticator noinherit login;
  grant anon, authenticated, service_role to authenticator;
exception when duplicate_object then null; end $$;

do $$ begin
  create role supabase_admin login createrole createdb replication bypassrls;
exception when duplicate_object then null; end $$;

do $$ begin
  create role supabase_auth_admin login createrole;
  grant usage on schema auth to supabase_auth_admin;
exception when duplicate_object then null; end $$;