-- Privileges for the application role (read/write on everything except role management) and the read-only public role.
DO $$ BEGIN
  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'wp_app') THEN
    GRANT USAGE ON SCHEMA public TO wp_app;
    GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO wp_app;
    GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO wp_app;
    ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO wp_app;
    ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO wp_app;
  END IF;
  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'wp_reader') THEN
    GRANT USAGE ON SCHEMA public TO wp_reader;
    GRANT SELECT ON series, authors, topics, methods, datasets, paper_authors, paper_topics, paper_methods, paper_datasets, redirects, paper_stats_daily TO wp_reader;
    GRANT SELECT ON public_papers, public_paper_versions, public_paper_chunks, public_paper_relations, public_settings, public_files TO wp_reader;
    GRANT INSERT ON events, search_log TO wp_reader;
    GRANT USAGE, SELECT ON SEQUENCE events_id_seq, search_log_id_seq TO wp_reader;
  END IF;
END $$;