From 576ae64fa36bad5b2a7907e76feafe7903958e07 Mon Sep 17 00:00:00 2001
From: Erol Haagenrud <erol.haagenrud@envide.no>
Date: Thu, 16 Jul 2026 08:24:48 +0200
Subject: [PATCH] Fix migration 002: psql does not interpolate :'var' inside DO
 $$ blocks

CREATE ROLE ... PASSWORD :'teecup_app_password' silently failed with
"syntax error at or near ':'" because the whole DO $$ ... $$ body is a
dollar-quoted string and psql skips variable substitution inside it.
Replaced the idempotency check with \gset + \if/\else so the PASSWORD
line is plain top-level SQL, where interpolation does work. Verified
against a scratch database (see test_isolation.sql run).
---
 002_roles_and_grants.sql | 32 +++++++++++++++++++-------------
 1 file changed, 19 insertions(+), 13 deletions(-)

diff --git a/002_roles_and_grants.sql b/002_roles_and_grants.sql
index 1dd41ef..f2c1efe 100644
--- a/002_roles_and_grants.sql
+++ b/002_roles_and_grants.sql
@@ -19,19 +19,25 @@
 
 -- --- Rolle (cluster-nivå: opprett bare hvis den ikke finnes) ----------
 -- Eksplisitt NOSUPERUSER / NOBYPASSRLS — dette er hele poenget.
-DO $$
-BEGIN
-    IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'teecup_app') THEN
-        CREATE ROLE teecup_app
-            LOGIN
-            PASSWORD :'teecup_app_password'
-            NOSUPERUSER
-            NOCREATEDB
-            NOCREATEROLE
-            NOBYPASSRLS
-            INHERIT;
-    END IF;
-END $$;
+-- MERK: dette var opprinnelig en DO $$ ... $$-blokk med
+-- "PASSWORD :'teecup_app_password'" inni. psql interpolerer ikke :'var'
+-- inne i dollar-quoted strenger, så det feilet alltid med
+-- "syntax error at or near ':'". Erstattet med \if/\else slik at
+-- PASSWORD-linjen står som vanlig SQL utenfor $$ $$ (verifisert mot
+-- scratch-database, se test_isolation.sql-kjøringen).
+SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'teecup_app') AS teecup_app_exists \gset
+\if :teecup_app_exists
+    \echo 'teecup_app finnes allerede, hopper over CREATE ROLE'
+\else
+    CREATE ROLE teecup_app
+        LOGIN
+        PASSWORD :'teecup_app_password'
+        NOSUPERUSER
+        NOCREATEDB
+        NOCREATEROLE
+        NOBYPASSRLS
+        INHERIT;
+\endif
 
 -- --- Grants (kjøres mens du er koblet til teecup_db) ------------------
 GRANT CONNECT ON DATABASE teecup_db TO teecup_app;