CREATE FUNCTION pg_temp.upsert_role(role_name TEXT, options TEXT, password TEXT = NULL) RETURNS void AS $$
  BEGIN
    EXECUTE format('CREATE ROLE %I WITH %s PASSWORD %L', role_name, options, password);
  EXCEPTION WHEN duplicate_object THEN
    EXECUTE format('ALTER ROLE %I WITH %s PASSWORD %L', role_name, options, password);
  END;
$$ LANGUAGE plpgsql;

DO $$
  BEGIN
    -- Create schema-owning user.
    PERFORM pg_temp.upsert_role('<%- config["postgresql"]["migrations"]["username"] %>', 'NOSUPERUSER NOCREATEDB NOCREATEROLE INHERIT LOGIN NOREPLICATION NOBYPASSRLS', '<%- config["postgresql"]["migrations"]["password"] %>');

    -- Create application user.
    PERFORM pg_temp.upsert_role('<%- config["postgresql"]["username"] %>', 'NOSUPERUSER NOCREATEDB NOCREATEROLE INHERIT LOGIN NOREPLICATION NOBYPASSRLS', '<%- config["postgresql"]["password"] %>');

    GRANT <%- config["postgresql"]["username"] %> TO <%- config["postgresql"]["migrations"]["username"] %> WITH ADMIN OPTION;
  END
$$;