#!/usr/bin/env bash
# After pg_restore --no-owner --no-acl: give app role full rights on non-system schemas.
# Do NOT ALTER SEQUENCE OWNER for serials linked to tables (Postgres rejects that);
# ALTER TABLE OWNER covers owned serials.
# Usage inside CTR: goa-pg-acl-fixup.sh <dbname> <owner_role>
set -euo pipefail
db="${1:?db}"
owner="${2:?owner}"
# owner is a fixed role name from the restore caller (no user input).
runuser -u postgres -- psql -d "$db" -v ON_ERROR_STOP=1 <<SQL
DO \$\$
DECLARE
  r record;
  own text := '${owner}';
BEGIN
  FOR r IN
    SELECT nspname
    FROM pg_namespace
    WHERE nspname NOT IN ('pg_catalog', 'information_schema', 'pg_toast')
      AND nspname NOT LIKE 'pg_temp_%'
      AND nspname NOT LIKE 'pg_toast_temp_%'
  LOOP
    EXECUTE format('ALTER SCHEMA %I OWNER TO %I', r.nspname, own);
    EXECUTE format('GRANT ALL ON SCHEMA %I TO %I', r.nspname, own);
    EXECUTE format('GRANT ALL ON ALL TABLES IN SCHEMA %I TO %I', r.nspname, own);
    EXECUTE format('GRANT ALL ON ALL SEQUENCES IN SCHEMA %I TO %I', r.nspname, own);
    EXECUTE format('GRANT ALL ON ALL FUNCTIONS IN SCHEMA %I TO %I', r.nspname, own);
  END LOOP;

  FOR r IN
    SELECT n.nspname, c.relname
    FROM pg_class c
    JOIN pg_namespace n ON n.oid = c.relnamespace
    WHERE c.relkind IN ('r', 'v', 'm', 'p')
      AND n.nspname NOT IN ('pg_catalog', 'information_schema', 'pg_toast')
      AND n.nspname NOT LIKE 'pg_temp_%'
      AND n.nspname NOT LIKE 'pg_toast_temp_%'
  LOOP
    EXECUTE format('ALTER TABLE %I.%I OWNER TO %I', r.nspname, r.relname, own);
  END LOOP;
END
\$\$;
SQL
echo "ACL_FIX_OK db=$db owner=$owner"