anchor.diff:          roles MySQL wildcards ("%" and "_") can be used to specify objects
           to be granted on, including databases, tables and columns names. A
           script runs periodically to find all matching objects and grants on
  -        them. Objects are denoted as "schema[.table[.column]]".
  +        them. Objects are denoted as "database[.table[.column]]".
         '';
         example = {
           top_role = [ "basic_role" ];
  
positive.code: { config, lib, pkgs, ... }:
  let
    inherit (builtins)
      elemAt filter isAttrs isList length trace ;
    inherit (lib)
      attrNames concatMapStrings concatMapStringsSep concatStrings
      concatStringsSep filterAttrs flatten mapAttrsToList mkIf mkOption
      optionalString replaceStrings splitString types ;
    inherit (types)
      attrsOf either listOf str submodule ;
  
    cfg = config.nixsap.apps.mariadb;
  
negative.code:     done
    '';
  
    configureRoles = ''
      CREATE TEMPORARY TABLE __roles (u CHAR(80));
      ${optionalString (allRoles != []) ''
        INSERT INTO __roles VALUES
          ${concatMapStringsSep "," (r: "('${r}')") allRoles}
          ;
      ''}
  
      -- Add new roles.
      SELECT CONCAT('CREATE ROLE \''', u, '\';')
      FROM __roles
      LEFT OUTER JOIN user
      ON u = user
      WHERE user IS NULL ;
  
      -- Remove old roles.
      SELECT CONCAT('DROP ROLE \''', user, '\';')
      FROM __roles
      RIGHT OUTER JOIN user
      ON u = user
      WHERE u IS NULL AND is_role = 'Y' ;
  
      DROP TABLE __roles;
  
  
      CREATE TEMPORARY TABLE __roles_mapping (u CHAR(80), r CHAR(80));
      ${concatMapAttrs (role: subroles: ''
        INSERT INTO __roles_mapping VALUES
        ${concatMapStringsSep "," (r: "('${role}', '${r}')") subroles}
        ;
      '') topRoles}
  
      -- Add new mappings.
      SELECT CONCAT('GRANT \''', r, '\' TO \''', u, '\';')
      FROM __roles_mapping
      LEFT OUTER JOIN roles_mapping
      ON r = role AND u = user
      WHERE user IS NULL OR role IS NULL ;
  
      -- Remove old mappings. Empty hosts correspond to roles.
      SELECT CONCAT('REVOKE \''', role, '\' FROM \''', user, '\';')
      FROM __roles_mapping
      RIGHT OUTER JOIN roles_mapping
      ON r = role AND u = user
      WHERE (u IS NULL OR r IS NULL) AND host = ${"''"} ;
  
      DROP TABLE __roles_mapping;
  
    '';
  
    roleType =
  