-- Backfill global API key rights for databases provisioned before catalog seeding
-- was added to sql/provision.sql. Safe to run repeatedly (ON CONFLICT updates descriptions).
INSERT INTO api_key_rights (api_key_rights_id, name, description)
VALUES
    (gen_random_uuid(), 'gateway.access', 'General gateway access when enforcement uses the default fallback'),
    (gen_random_uuid(), 'gateway.read', 'Read rows via gateway fetch'),
    (gen_random_uuid(), 'gateway.write', 'Insert or update via gateway'),
    (gen_random_uuid(), 'gateway.delete', 'Delete rows via gateway'),
    (gen_random_uuid(), 'gateway.query', 'Execute SQL/CQL via gateway query'),
    (gen_random_uuid(), 'gateway.rpc.execute', 'Execute Postgres functions through Athena RPC routes'),
    (gen_random_uuid(), 'gateway.*', 'Wildcard gateway access'),
    (gen_random_uuid(), 'management.read', 'Read management capabilities for a client'),
    (gen_random_uuid(), 'management.tables.write', 'Create or alter managed tables'),
    (gen_random_uuid(), 'management.tables.drop', 'Drop managed tables'),
    (gen_random_uuid(), 'management.columns.write', 'Alter managed columns'),
    (gen_random_uuid(), 'management.columns.drop', 'Drop managed columns'),
    (gen_random_uuid(), 'management.indexes.write', 'Create managed indexes'),
    (gen_random_uuid(), 'management.indexes.drop', 'Drop managed indexes'),
    (gen_random_uuid(), 'management.functions.read', 'List managed Postgres functions'),
    (gen_random_uuid(), 'management.functions.write', 'Create or replace managed Postgres functions'),
    (gen_random_uuid(), 'management.functions.drop', 'Drop managed Postgres functions'),
    (gen_random_uuid(), 'management.*', 'Wildcard management access for a client')
ON CONFLICT (name) DO UPDATE
SET description = EXCLUDED.description,
    updated_at = now();
