-- PostgreSQL initialization script for FromChat compliance architecture
-- Creates separate databases and users for each service with minimal required permissions

-- Create users with passwords from environment variables
-- Variables are substituted by envsubst before PostgreSQL runs this script
CREATE USER main_user WITH PASSWORD '${MAIN_DB_PASSWORD}';
CREATE USER messaging_user WITH PASSWORD '${MESSAGING_DB_PASSWORD}';
CREATE USER file_storage_user WITH PASSWORD '${FILE_STORAGE_DB_PASSWORD}';

-- Create databases for each service
CREATE DATABASE fromchat_main OWNER main_user;
CREATE DATABASE fromchat_messaging OWNER messaging_user;
CREATE DATABASE fromchat_files OWNER file_storage_user;

-- Connect to main database and set up
\c fromchat_main
CREATE SCHEMA IF NOT EXISTS fromchat_main AUTHORIZATION main_user;
GRANT ALL PRIVILEGES ON DATABASE fromchat_main TO main_user;
GRANT ALL PRIVILEGES ON SCHEMA fromchat_main TO main_user;
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA fromchat_main TO main_user;
ALTER DEFAULT PRIVILEGES IN SCHEMA fromchat_main GRANT ALL ON TABLES TO main_user;
ALTER DEFAULT PRIVILEGES IN SCHEMA fromchat_main GRANT ALL ON SEQUENCES TO main_user;

-- Connect to messaging database and set up
\c fromchat_messaging
CREATE SCHEMA IF NOT EXISTS fromchat_messaging AUTHORIZATION messaging_user;
GRANT ALL PRIVILEGES ON DATABASE fromchat_messaging TO messaging_user;
GRANT USAGE ON SCHEMA fromchat_messaging TO messaging_user;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA fromchat_messaging TO messaging_user;
GRANT USAGE ON ALL SEQUENCES IN SCHEMA fromchat_messaging TO messaging_user;
ALTER DEFAULT PRIVILEGES IN SCHEMA fromchat_messaging GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO messaging_user;
ALTER DEFAULT PRIVILEGES IN SCHEMA fromchat_messaging GRANT USAGE ON SEQUENCES TO messaging_user;

-- Connect to files database and set up
\c fromchat_files
CREATE SCHEMA IF NOT EXISTS fromchat_files AUTHORIZATION file_storage_user;
GRANT ALL PRIVILEGES ON DATABASE fromchat_files TO file_storage_user;
GRANT USAGE ON SCHEMA fromchat_files TO file_storage_user;
GRANT SELECT, INSERT, UPDATE ON ALL TABLES IN SCHEMA fromchat_files TO file_storage_user;
GRANT USAGE ON ALL SEQUENCES IN SCHEMA fromchat_files TO file_storage_user;
ALTER DEFAULT PRIVILEGES IN SCHEMA fromchat_files GRANT SELECT, INSERT, UPDATE ON TABLES TO file_storage_user;
ALTER DEFAULT PRIVILEGES IN SCHEMA fromchat_files GRANT USAGE ON SEQUENCES TO file_storage_user;