-- Creates the application role used by the API (RLS applies to it; it cannot bypass policies).
-- The password MUST be changed per environment and mirrored in DATABASE_URL.
DO $$
BEGIN
  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'wms_app') THEN
    CREATE ROLE wms_app LOGIN PASSWORD 'change-me-wms-app' NOBYPASSRLS;
  END IF;
END $$;
GRANT CONNECT ON DATABASE wms TO wms_app;