Use a new test user in tests to reduce privileges

compose/bootstrap.sql

@@ -8,7 +8,6 @@ create role if not exists R_THROTTLER;
 grant SELECT on performance_schema.replication_applier_status_by_worker to R_THROTTLER;
 grant SELECT on performance_schema.replication_connection_status to R_THROTTLER;
 
-
 create user if not exists msandbox@'%' identified with caching_sha2_password by 'msandbox';
 grant R_MIGRATOR, R_REPLICATION to msandbox@'%' ;
 set default role R_MIGRATOR, R_REPLICATION to msandbox@'%';
@@ -17,6 +16,13 @@ create user if not exists rsandbox@'%' identified with caching_sha2_password by
 grant R_REPLICATION, R_THROTTLER to rsandbox@'%';
 set default role R_REPLICATION, R_THROTTLER to rsandbox@'%';
 
+-- unfortunately the password for tsandbox must be the same as the password for root because in tests we switch to root
+-- using the same password.
+create user if not exists tsandbox@'%' identified with caching_sha2_password by 'msandbox';
+grant R_MIGRATOR, R_REPLICATION to tsandbox@'%' ;
+grant SYSTEM_VARIABLES_ADMIN on *.* to tsandbox@'%'; -- used in tests
+set default role R_MIGRATOR, R_REPLICATION to tsandbox@'%';
+
 flush privileges;
 
 create database if not exists test;

compose/compose.yml

@@ -26,7 +26,7 @@ services:
       mysql:
         condition: service_healthy
     environment:
-      MYSQL_DSN: root:msandbox@tcp(mysql)/test
+      MYSQL_DSN: tsandbox:msandbox@tcp(mysql)/test
 
   buildandrun:
     build:

compose/replication/compose.yml

@@ -52,7 +52,7 @@ services:
       mysql_replica:
         condition: service_healthy
     environment:
-      MYSQL_DSN: root:msandbox@tcp(mysql)/test
+      MYSQL_DSN: tsandbox:msandbox@tcp(mysql)/test
       REPLICA_DSN: rsandbox:rsandbox@tcp(mysql_replica)/
 
   buildandrun: