-- Grant CREATEDB to the Zammad PostgreSQL role.
-- Zammad's init script unconditionally runs `rake db:create` even when the
-- database already exists; without CREATEDB the call fails with
-- `PG::InsufficientPrivilege: permission denied to create database`.
-- Role name is rendered via Jinja (NOT via database_query's named_args)
-- because psql parameter binding quotes string values as literals
-- (`'zammad'`) and ALTER ROLE 'zammad' is invalid SQL — identifiers must
-- be bareword or double-quoted. lookup('database', …, 'username') is
-- trusted SPOT data.
ALTER ROLE "{{ lookup('database', application_id, 'username') }}" WITH CREATEDB;