-- Read-only role used by the Grafana PostgreSQL datasource for the PO Overview
-- dashboard (issue #651). The role is created here without a usable password
-- (LOGIN-capable but no password set); R__grafana_reader_password.sql sets the
-- password from GRAFANA_DB_PASSWORD on every boot, so rotation is just "bump
-- the env var and restart the backend" — see docs/adr/024-* and the rotation
-- runbook in docs/DEPLOYMENT.md.
DO $$
BEGIN
    IF NOT EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'grafana_reader') THEN
        CREATE ROLE grafana_reader WITH LOGIN;
    END IF;
END
$$;

GRANT CONNECT ON DATABASE ${flyway:database} TO grafana_reader;
GRANT USAGE  ON SCHEMA   public               TO grafana_reader;
GRANT SELECT ON audit_log, documents, transcription_blocks TO grafana_reader;
