---
-
  name: Ensure default user is present.
  community.mysql.mysql_user:
    name: "{{ mysql_user_name }}"
    host: 'localhost'
    password: "{{ mysql_user_password }}"
    priv: '*.*:ALL,GRANT'
    state: present
  no_log: "{{ mysql_hide_passwords }}"
  when: mysql_user_name != mysql_root_username

# Has to be after the password assignment, for idempotency.
-
  name: Copy user-my.cnf file with password credentials.
  ansible.builtin.template:
    src: "user-my.cnf.j2"
    dest: "{{ mysql_user_home }}/.my.cnf"
    owner: "{{ mysql_user_name }}"
    mode: "0600"
  no_log: "{{ mysql_hide_passwords }}"
  when: >
    mysql_user_name != mysql_root_username
    and (mysql_install_packages | bool or mysql_user_password_update)

-
  name: Disallow root login remotely
  ansible.builtin.command: 'mysql -NBe "{{ item }}"'
  with_items:
    - DELETE FROM mysql.user WHERE User='{{ mysql_root_username }}' AND Host NOT IN ('localhost', '127.0.0.1', '::1')
  changed_when: false

-
  name: Get list of hosts for the root user.
  ansible.builtin.command: mysql -NBe
    "SELECT Host
    FROM mysql.user
    WHERE User = '{{ mysql_root_username }}'
    ORDER BY (Host='localhost') ASC"
  register: mysql_root_hosts
  changed_when: false
  check_mode: false
  when: mysql_install_packages | bool or mysql_root_password_update

# Note: We do not use mysql_user for this operation, as it doesn't always update
# the root password correctly. See: https://goo.gl/MSOejW
# Set root password for MySQL >= 5.7.x.
-
  name: Update MySQL root password for localhost root account (5.7.x).
  ansible.builtin.shell: >
    mysql -u root -NBe
    "ALTER USER '{{ mysql_root_username }}'@'{{ item }}'
     IDENTIFIED WITH mysql_native_password BY '{{ mysql_root_password }}'; FLUSH PRIVILEGES;"
  changed_when: false
  no_log: "{{ mysql_hide_passwords }}"
  with_items: "{{ mysql_root_hosts.stdout_lines | default([]) }}"
  when: >
    ((mysql_install_packages | bool) or mysql_root_password_update)
    and ('5.7.' in mysql_cli_version.stdout or '8.0.' in mysql_cli_version.stdout)

# Set root password for MySQL < 5.7.x.
-
  name: Update MySQL root password for localhost root account (< 5.7.x).
  ansible.builtin.shell: >
    mysql -NBe
    'SET PASSWORD FOR "{{ mysql_root_username }}"@"{{ item }}" = PASSWORD("{{ mysql_root_password }}"); FLUSH PRIVILEGES;'
  no_log: "{{ mysql_hide_passwords }}"
  changed_when: false
  with_items: "{{ mysql_root_hosts.stdout_lines | default([]) }}"
  when: >
    ((mysql_install_packages | bool) or mysql_root_password_update)
    and ('5.7.' not in mysql_cli_version.stdout and '8.0.' not in mysql_cli_version.stdout)

# Has to be after the root password assignment, for idempotency.
-
  name: Copy .my.cnf file with root password credentials.
  ansible.builtin.template:
    src: "root-my.cnf.j2"
    dest: "{{ mysql_root_home }}/.my.cnf"
    owner: root
    group: root
    mode: "0600"
  no_log: "{{ mysql_hide_passwords }}"
  when: mysql_install_packages | bool or mysql_root_password_update

-
  name: Get list of hosts for the anonymous user.
  ansible.builtin.command: mysql -NBe "SELECT Host FROM mysql.user WHERE User = ''"
  register: mysql_anonymous_hosts
  changed_when: false
  check_mode: false

-
  name: Remove anonymous MySQL users.
  community.mysql.mysql_user:
    name: ""
    host: "{{ item }}"
    state: absent
  with_items: "{{ mysql_anonymous_hosts.stdout_lines | default([]) }}"

-
  name: Remove MySQL test database.
  community.mysql.mysql_db:
    name: 'test'
    state: absent
