select 'create role anon nologin nosuperuser nocreatedb nocreaterole noinherit'
where not exists (select 1 from pg_roles where rolname = 'anon') \gexec
select 'create role authenticated nologin nosuperuser nocreatedb nocreaterole noinherit'
where not exists (select 1 from pg_roles where rolname = 'authenticated') \gexec
select 'create role service_role nologin nosuperuser nocreatedb nocreaterole noinherit bypassrls'
where not exists (select 1 from pg_roles where rolname = 'service_role') \gexec

alter role service_role bypassrls;

\getenv service_runtime_password SERVICE_RUNTIME_PASSWORD
select format(
  'create role service_runtime with login nosuperuser nocreatedb nocreaterole noinherit password %L',
  :'service_runtime_password'
) where not exists (select 1 from pg_roles where rolname = 'service_runtime') \gexec
select format('grant connect on database %I to service_runtime', current_database()) \gexec

grant authenticated to app_runtime;
grant service_role to service_runtime;
revoke service_role from admin_runtime;