Archetype: sql_service_account_roles_populate.mustache

{{! GENERATED FILE — tangled from projects/ores.codegen/library/templates/sql_service.org. Edit the org source. }}
{{{sql_license}}}

/**
 * AUTO-GENERATED FILE - DO NOT EDIT MANUALLY
 * Template: sql_service_account_roles_populate.mustache
 *
 * Service Account Role Assignments
 *
 * Assigns each domain service account its corresponding NATS RBAC role.
 * Must run after iam_service_accounts_populate.sql and iam_roles_populate.sql.
 *
 * This script is idempotent.
 */

\echo '--- Service Account Role Assignments ---'

{{#service_registry}}
{{#services}}
select ores_iam_account_role_assign_fn(
    ores_utility_system_tenant_id_fn(), :'{{psql_var}}_user', '{{iam_role}}');

{{/services}}
{{/service_registry}}
-- Summary
select 'Service Account Role Assignments' as entity, count(*) as count
from ores_iam_account_roles_tbl ar
join ores_iam_accounts_tbl a on a.id = ar.account_id
where a.account_type != 'user'
  and ar.valid_to = ores_utility_infinity_timestamp_fn();