DO $$
BEGIN
    IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'diwall_core_app') THEN
        CREATE ROLE diwall_core_app WITH LOGIN PASSWORD 'password' NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT;
    END IF;
END $$;

ALTER ROLE diwall_core_app NOBYPASSRLS;

GRANT USAGE ON SCHEMA public TO diwall_core_app;

GRANT SELECT ON tenants TO diwall_core_app;
GRANT SELECT ON users TO diwall_core_app;

GRANT SELECT, INSERT ON audit_log TO diwall_core_app;
GRANT SELECT, INSERT ON pii_audit_log TO diwall_core_app;
GRANT SELECT, INSERT, UPDATE ON job_queue TO diwall_core_app;
GRANT SELECT, INSERT, UPDATE ON employees TO diwall_core_app;
GRANT SELECT, INSERT ON disc_profiles TO diwall_core_app;
GRANT SELECT, INSERT, UPDATE ON checkins TO diwall_core_app;

GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO diwall_core_app;
