-- Re-runnable script to (re)create the read-only Power BI reporting account.
-- Use when the MySQL volume was initialized before POWERBI_RO_PASSWORD was set:
--
--   docker compose exec -T mysql \
--     sh -c 'mysql -u root -p"$MYSQL_ROOT_PASSWORD" "$MYSQL_DATABASE"' < scripts/powerbi_grants.sql
--
-- Then set the password (replace the placeholder):
--   ALTER USER 'powerbi_ro'@'%' IDENTIFIED BY '<POWERBI_RO_PASSWORD>';

CREATE USER IF NOT EXISTS 'powerbi_ro'@'%' IDENTIFIED BY 'CHANGE_ME_NOW';
GRANT SELECT ON `pesco_ncr`.`vw_ncr_full`          TO 'powerbi_ro'@'%';
GRANT SELECT ON `pesco_ncr`.`vw_ncr_stage_history` TO 'powerbi_ro'@'%';
GRANT SELECT ON `pesco_ncr`.`vw_ncr_costs`         TO 'powerbi_ro'@'%';
FLUSH PRIVILEGES;