/* Who does the database think the console's read role is?
 *
 *   node scripts/ops-ro-whoami.cjs
 *
 * The ops_ro grants are column allow-lists, and the probe (scripts/ops-ro-probe.cjs) checks them
 * by asking for things the role must not see. If every refusal comes back readable, the first
 * suspect is not the grants but the server: an embedded development Postgres may accept any
 * username and run everything as its one superuser, which makes every grant meaningless THERE
 * and says nothing about production. This prints enough to tell the two apart.
 */
require("dotenv/config");
const { Client } = require("pg");
(async () => {
  const c = new Client({ connectionString: process.env.OPS_DATABASE_URL });
  await c.connect();
  const r = await c.query(
    "SELECT current_user, session_user, (SELECT rolsuper FROM pg_roles WHERE rolname = current_user) AS superuser, " +
    "(SELECT rolsuper FROM pg_roles WHERE rolname = 'ops_ro') AS ops_ro_is_super, version() AS version"
  );
  console.log(r.rows[0]);
  await c.end();
})().catch((e) => { console.error(e.message); process.exit(1); });