-- T-009 cluster roles. Runtime login roles are deployment-specific members of
-- these NOLOGIN roles; passwords and login principals never belong in Git.

DO $roles$
DECLARE
    role_record pg_roles%ROWTYPE;
BEGIN
    SELECT * INTO role_record FROM pg_roles WHERE rolname = 'bell_app';
    IF NOT FOUND THEN
        CREATE ROLE bell_app NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION;
    ELSIF role_record.rolsuper OR role_record.rolcreatedb OR role_record.rolcreaterole
          OR role_record.rolreplication OR role_record.rolcanlogin THEN
        RAISE EXCEPTION 'existing bell_app role has unsafe attributes';
    END IF;

    SELECT * INTO role_record FROM pg_roles WHERE rolname = 'sense_app';
    IF NOT FOUND THEN
        CREATE ROLE sense_app NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION;
    ELSIF role_record.rolsuper OR role_record.rolcreatedb OR role_record.rolcreaterole
          OR role_record.rolreplication OR role_record.rolcanlogin THEN
        RAISE EXCEPTION 'existing sense_app role has unsafe attributes';
    END IF;
END
$roles$;