fix: restore analytics user password via shell interpolation (#17)

Author: passcod

src/controllers/restore/builders.rs

@@ -599,16 +599,19 @@ fi
 
 echo "Detected PG major version: $PG_MAJOR"
 
+# ANALYTICS_PASSWORD is generated by the operator (see replica.rs generate_password)
+# and stored in a Kubernetes secret - it is not user-controlled input, so
+# interpolating it directly into the SQL string is safe.
 psql -U postgres -d postgres << SQLEOF
-\getenv analytics_password ANALYTICS_PASSWORD
 DO \$\$
 BEGIN
   IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '${{ANALYTICS_USERNAME}}') THEN
-    CREATE ROLE ${{ANALYTICS_USERNAME}} WITH LOGIN;
+    CREATE ROLE ${{ANALYTICS_USERNAME}} WITH LOGIN PASSWORD '${{ANALYTICS_PASSWORD}}';
+  ELSE
+    ALTER ROLE ${{ANALYTICS_USERNAME}} WITH PASSWORD '${{ANALYTICS_PASSWORD}}';
   END IF;
 END
 \$\$;
-ALTER ROLE ${{ANALYTICS_USERNAME}} WITH PASSWORD :'analytics_password';
 SQLEOF
 
 if [ "$PG_MAJOR" -ge 14 ] && [ "{read_only}" = "true" ]; then