# PostSync Job to grant schema permissions after Database CRs reconcile
# CNPG Database CR creates DBs but doesn't set schema permissions correctly
apiVersion: v1
kind: ServiceAccount
metadata:
  name: db-permissions
  namespace: ddb
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: db-permissions
  namespace: ddb
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: db-permissions
  namespace: ddb
subjects:
  - kind: ServiceAccount
    name: db-permissions
    namespace: ddb
roleRef:
  kind: Role
  name: db-permissions
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: batch/v1
kind: Job
metadata:
  name: db-permissions
  namespace: ddb
  annotations:
    argocd.argoproj.io/hook: PostSync
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
spec:
  backoffLimit: 5
  template:
    spec:
      serviceAccountName: db-permissions
      restartPolicy: Never
      containers:
      - name: grant-permissions
        image: postgres:16-alpine
        command:
        - /bin/sh
        - -c
        - |
          set -e
          
          echo "Granting schema permissions to app users..."
          
          # Get app user password
          export PGPASSWORD=$(cat /postgres-secret/password)
          
          # Grant for authentik (as app user, owner of the DB)
          psql -h ddb-cluster-rw -U app -d authentik << 'SQL'
          GRANT ALL ON SCHEMA public TO app;
          GRANT ALL ON SCHEMA public TO authentik;
          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO app;
          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO app;
          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO authentik;
          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authentik;
          SQL
          
          # Grant for temporal
          psql -h ddb-cluster-rw -U app -d temporal << 'SQL'
          GRANT ALL ON SCHEMA public TO app;
          GRANT ALL ON SCHEMA public TO temporal;
          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO app;
          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO app;
          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO temporal;
          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO temporal;
          SQL
          
          # Grant for temporal_visibility
          psql -h ddb-cluster-rw -U app -d temporal_visibility << 'SQL'
          GRANT ALL ON SCHEMA public TO app;
          GRANT ALL ON SCHEMA public TO temporal;
          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO app;
          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO app;
          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO temporal;
          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO temporal;
          SQL
          
          echo "Permissions granted successfully"
        volumeMounts:
        - name: postgres-secret
          mountPath: /postgres-secret
          readOnly: true
      volumes:
      - name: postgres-secret
        secret:
          secretName: ddb-cluster-app