#!/usr/bin/env python3
"""Create a read-only account in the isolated MySQL staging container."""

import json
import re
import subprocess

from create_private_credentials import TARGET


def main() -> None:
    credential = json.loads(TARGET.read_text(encoding="utf-8"))["SOURCE_MYSQL"]
    user, secret = credential["user"], credential["password"]
    if not re.fullmatch(r"[a-z_]+", user) or not re.fullmatch(r"[A-Za-z0-9@#_]{24}", secret):
        raise ValueError("Unexpected credential format")
    sql = (
        f"CREATE USER '{user}'@'%' IDENTIFIED BY '{secret}';\n"
        f"GRANT SELECT, SHOW VIEW ON `zhct`.* TO '{user}'@'%';\n"
        f"GRANT SELECT, SHOW VIEW ON `aizhct`.* TO '{user}'@'%';\n"
    )
    result = subprocess.run(
        ["docker", "exec", "-i", "dm8-mysql56-newsource-20260928", "mysql"],
        input=sql,
        capture_output=True,
        text=True,
    )
    if result.returncode:
        raise SystemExit(f"Staging user creation failed; exit={result.returncode}; stderr withheld")
    print("Isolated MySQL read-only user created for both source schemas")


if __name__ == "__main__":
    main()