#!/usr/bin/env bash

# Quick and dirty script to automate the user creation process.
#
# This script expects .aws/(config|credentials), .my.cnf, and .pgpass files
# to be configured for the user running this script.
#
# AWS config files should specify 'dev' and 'prod' profiles
#
# .pgpass files should have host and cluster-specific credentials as needed
#
# .my.cnf files should follow the following syntax, with one entry per host
# in which $DBHOSTNAME is replaced by each of the MySQL hosts specified below:
#
# Syntax:
#    [mysql{$DBHOSTNAME}]
#    user=user
#    password="password"
#
# Example:
#   [mysqlprodserver.theorchard.com]
#    user=orchardproduser
#    password="prodpassword123"
#
#   [mysqlqaserver.qaorch.com]
#    user=orchardqauser
#    password="qapassword123"
#
#
# ~/.snowsql/config is used for Snowflake, and should at a minimum have the following fields populated:
# [conections]
#
# accountname = orchard
# username = some_username
# password = some_password123
# dbname = some_db (ideally something safe like DEMO_DB)
# rolename = role_name_with_appropriate_privileges
# schemaname = schema_name (ideally something safe like public)
#


# Global Variables
NEW_USERNAME=''
AWS_PROFILE=''
SNOWFLAKE_DEFAULT_ROLE='DEV_ENGINEERING'
SNOWFLAKE_DEFAULT_WAREHOUSE='DEV_OWS_WAREHOUSE'

# Specify binary locations
PSQL='/Applications/Postgres.app/Contents/Versions/latest/bin/psql'
MYSQL='/usr/bin/env mysql'
SNOWSQL=$(which snowsql)

# Redshift info
REDSHIFT_DEV_HOSTS='dev-db02.redshift.theorchard.com'
REDSHIFT_PROD_HOSTS=('db04.redshift.theorchard.com' 'db07.redshift.theorchard.com' 'db10.redshift.theorchard.com')
REDSHIFT_PORT='5439'
REDSHIFT_DEFAULT_DB='dev'

# MySQL info
MYSQL_DEV_SERVER_HOST='phys.db.devorch.com'
MYSQL_REPORTSAR_HOST=('reportsar.theorchard.com' 'reportsar02.theorchard.com')
MYSQL_REPORTSDD_HOST=('reportsdd.theorchard.com' 'reportsdd02.theorchard.com')
MYSQL_STATEMENTDB_HOST='statementdb.theorchard.com'
MYSQL_PROD_OWS_RDS_HOSTS=('prod-ows.rds.theorchard.com' 'prod-ows02.rds.theorchard.com')
MYSQL_QA_AR_SERVER_HOST='qa.db.qaorch.com'
MYSQL_QA_DD_SERVER_HOST='qadddb.qaorch.com'
MYSQL_QA_OWS_RDS_HOST='qa-ows.rds.theorchard.com'

# Service Flags
CREATE_MYSQL_AR_DEV=false
CREATE_MYSQL_REPORTSAR=false
CREATE_MYSQL_REPORTSDD=false
CREATE_MYSQL_STATEMENTDB=false
CREATE_REDSHIFT_PROD=false
CREATE_MYSQL_AR_QA=false
CREATE_MYSQL_DD_QA=false
CREATE_MYSQL_OWS_RDS_PROD=false
CREATE_MYSQL_OWS_RDS_QA=false
CREATE_REDSHIFT_DEV=false
CREATE_SNOWFLAKE=false
RDS_QA_DB=''
RDS_PROD_DB=''
if [ -z "${AWS_DEFAULT_REGION}" ]; then
  AWS_DEFAULT_REGION='us-east-1'
fi

VERBOSE=false

function verify_username {
  # Check to make sure username is present and does not contain unsupported characters.

  [ "${VERBOSE}" = true ] && printf '%s\n' "Verifying username"

  DISALLOWED_CHARS='[[:punct:]][[:space:]]'

  if [ -z "${NEW_USERNAME}" ]; then
    printf '%s\n' "Username cannot be empty. Please submit with the -u parameter." && exit 1
  elif [[ ${NEW_USERNAME} =~ ${DISALLOWED_CHARS} ]]; then
    printf '%s\n' "Username contains unsupported characters." && exit 1
  else
    printf '%s\n' " Username is good"
    return 0
  fi
}

function generate_password {
  # Certain systems require numbers in passwords and others only support
  # alphanumeric characters, so make this the lowest common denominator.

  PASSWORD_CONTAINS_NUMBER=false

  while [ "${PASSWORD_CONTAINS_NUMBER}" = false ]; do
    NEW_PASSWORD="$(cat /dev/urandom | LC_ALL=C tr -dc "a-zA-Z0-9" | fold -w 24 | head -n 1)"
    if echo "${NEW_PASSWORD}" | grep '[0-9]' >/dev/null; then
      PASSWORD_CONTAINS_NUMBER=true
      printf "${NEW_PASSWORD}"
    fi
done
}

function generate_complex_password {
  # Certain systems actually require complex passwords.
  # Here is a somewhat repetitive function for that.

  PASSWORD_CONTAINS_SPECIAL=false

  while [ "${PASSWORD_CONTAINS_SPECIAL}" = false ]; do
    NEW_PASSWORD="$(cat /dev/urandom | LC_ALL=C tr -dc "[:alnum:]\!@#\$^\&\*()_+-=\[\]{}|" | fold -w 24 | head -n 1)"
    if echo "${NEW_PASSWORD}" | grep '[0-9]' >/dev/null; then
      if echo "${NEW_PASSWORD}" | grep '[-?^#@]' >/dev/null; then
        PASSWORD_CONTAINS_SPECIAL=true
        printf "${NEW_PASSWORD}"
      fi
    fi
  done
}

function generate_mysql_password {
  # Prior to MySQL 5.7, the character limit is 16

  PASSWORD_CONTAINS_NUMBER=false

  while [ "${PASSWORD_CONTAINS_NUMBER}" = false ]; do
    NEW_PASSWORD="$(cat /dev/urandom | LC_ALL=C tr -dc "a-zA-Z0-9" | fold -w 16 | head -n 1)"
    if echo "${NEW_PASSWORD}" | grep '[0-9]' >/dev/null; then
      PASSWORD_CONTAINS_NUMBER=true
      printf "${NEW_PASSWORD}"
    fi
done
}

function generate_mysql_long_password {
  # Prior to MySQL 5.7, the character limit is 16

  NEW_PASSWORD="$(openssl rand -base64 32)"
  printf "${NEW_PASSWORD}"
}

function create_mysql_ar_dev_user {
  # Create a MySQL dev art_relations db user

  [ "${VERBOSE}" = true ] && printf '%s\n' "Generating MySQL dev art_relations db user"

  verify_username

  PASSWORD=$(generate_mysql_password)
  printf '%s\n' "The password for MySQL dev art_relations dbs is ${PASSWORD}"

  MYSQL_COMMAND_STRING="${MYSQL} --defaults-group-suffix=${MYSQL_DEV_SERVER_HOST} -h ${MYSQL_DEV_SERVER_HOST} -N"
  MYSQL_HASHED_PASSWORD=$(echo "select password('${PASSWORD}')" | ${MYSQL_COMMAND_STRING})

  #echo "use mysql; insert into user (Host, User, Password, Select_priv, Insert_priv, Update_priv, Delete_priv, Create_priv, Drop_priv, Reload_priv, Shutdown_priv, Process_priv, File_priv, Grant_priv, References_priv, Index_priv, Alter_priv, Show_db_priv, Super_priv, Create_tmp_table_priv, Lock_tables_priv, Execute_priv, Repl_slave_priv, Repl_client_priv, Create_view_priv, Show_view_priv, Create_routine_priv, Alter_routine_priv, Create_user_priv, Event_priv, Trigger_priv, Create_tablespace_priv, ssl_type, ssl_cipher, x509_issuer, x509_subject, max_questions, max_updates, max_connections, max_user_connections, plugin, authentication_string, password_expired) values('%','${NEW_USERNAME}','${MYSQL_HASHED_PASSWORD}','Y','Y','Y','Y','Y','Y','Y','N','Y','Y','N','Y','Y','Y','Y','N','Y','Y','Y','N','N','Y','Y','Y','Y','N','Y','Y','N','','','','','0','0','0','0','mysql_native_password','','N');" | ${MYSQL_COMMAND_STRING}
  echo "CREATE USER '${NEW_USERNAME}'@'%' IDENTIFIED BY PASSWORD '${MYSQL_HASHED_PASSWORD}';" | ${MYSQL_COMMAND_STRING}
  echo "GRANT ALTER, ALTER ROUTINE, CREATE, CREATE ROUTINE, CREATE TEMPORARY TABLES, CREATE VIEW, DELETE, DROP, EXECUTE, FILE, INDEX, INSERT, LOCK TABLES, PROCESS, REFERENCES, SELECT, SHOW DATABASES, SHOW VIEW, TRIGGER, UPDATE ON *.* TO '${NEW_USERNAME}'@'%';" | ${MYSQL_COMMAND_STRING}
  echo "FLUSH PRIVILEGES;" | ${MYSQL_COMMAND_STRING}
}

function create_mysql_reportsar_user {
  # Create a MySQL reportsar db user

  [ "${VERBOSE}" = true ] && printf '%s\n' "Generating MySQL reportsar user"

  verify_username

  PASSWORD=$(generate_mysql_password)
  printf '%s\n' "The password for MySQL reportsar is ${PASSWORD}"

  for HOST in "${MYSQL_REPORTSAR_HOST[@]}"; do
    [ "${VERBOSE}" = true ] && printf '%s\n' "Generating mysql user on ${HOST}"

    MYSQL_COMMAND_STRING="${MYSQL} --defaults-group-suffix=${HOST} -h ${HOST} -N"
    MYSQL_HASHED_PASSWORD=$(echo "select password('${PASSWORD}')" | ${MYSQL_COMMAND_STRING})

    echo "CREATE USER '${NEW_USERNAME}'@'%' IDENTIFIED BY PASSWORD '${MYSQL_HASHED_PASSWORD}';" | ${MYSQL_COMMAND_STRING}
    echo "GRANT SELECT, SHOW VIEW ON *.* TO '${NEW_USERNAME}'@'%';" | ${MYSQL_COMMAND_STRING}
    echo "FLUSH PRIVILEGES;" | ${MYSQL_COMMAND_STRING}
  done
}

function create_mysql_reportsdd_user {
  # Create a MySQL reportsdd db user

  [ "${VERBOSE}" = true ] && printf '%s\n' "Generating MySQL reportsdd user"

  verify_username

  PASSWORD=$(generate_mysql_password)
  printf '%s\n' "The password for MySQL reportsdd is ${PASSWORD}"

  for HOST in "${MYSQL_REPORTSDD_HOST[@]}"; do
    [ "${VERBOSE}" = true ] && printf '%s\n' "Generating mysql user on ${HOST}"

    MYSQL_COMMAND_STRING="${MYSQL} --defaults-group-suffix=${HOST} -h ${HOST} -N"
    MYSQL_HASHED_PASSWORD=$(echo "select password('${PASSWORD}')" | ${MYSQL_COMMAND_STRING})

    echo "CREATE USER '${NEW_USERNAME}'@'%' IDENTIFIED BY PASSWORD '${MYSQL_HASHED_PASSWORD}';" | ${MYSQL_COMMAND_STRING}
    echo "GRANT SELECT, SHOW VIEW ON *.* TO '${NEW_USERNAME}'@'%';" | ${MYSQL_COMMAND_STRING}
    echo "FLUSH PRIVILEGES;" | ${MYSQL_COMMAND_STRING}
  done

}

function create_mysql_statementdb_user {
  # Create a MySQL statement db user

  [ "${VERBOSE}" = true ] && printf '%s\n' "Generating MySQL statementdb user"

  verify_username

  PASSWORD=$(generate_mysql_long_password)
  printf '%s\n' "The password for MySQL statementdb is ${PASSWORD}"

  MYSQL_COMMAND_STRING="${MYSQL} --defaults-group-suffix=${MYSQL_STATEMENTDB_HOST} -h ${MYSQL_STATEMENTDB_HOST} -N"
  MYSQL_HASHED_PASSWORD=$(echo "select password('${PASSWORD}')" | ${MYSQL_COMMAND_STRING})

  echo "CREATE USER '${NEW_USERNAME}'@'%' IDENTIFIED BY PASSWORD '${MYSQL_HASHED_PASSWORD}';" | ${MYSQL_COMMAND_STRING}
  echo "GRANT SELECT, SHOW VIEW ON *.* TO '${NEW_USERNAME}'@'%';" | ${MYSQL_COMMAND_STRING}
  echo "FLUSH PRIVILEGES;" | ${MYSQL_COMMAND_STRING}
}

function create_mysql_ar_qa_user {
  # Create a MySQL qa art_relations db user

  [ "${VERBOSE}" = true ] && printf '%s\n' "Generating MySQL qa art_relations user"

  verify_username

  PASSWORD=$(generate_mysql_password)
  printf '%s\n' "The password for MySQL qa art_relations is ${PASSWORD}"

  MYSQL_COMMAND_STRING="${MYSQL} --defaults-group-suffix=${MYSQL_QA_AR_SERVER_HOST} -h ${MYSQL_QA_AR_SERVER_HOST} -N"
  MYSQL_HASHED_PASSWORD=$(echo "select password('${PASSWORD}')" | ${MYSQL_COMMAND_STRING})

  echo "CREATE USER '${NEW_USERNAME}'@'%' IDENTIFIED BY PASSWORD '${MYSQL_HASHED_PASSWORD}';" | ${MYSQL_COMMAND_STRING}
  echo "GRANT SELECT, SHOW VIEW ON *.* TO '${NEW_USERNAME}'@'%';" | ${MYSQL_COMMAND_STRING}
  echo "FLUSH PRIVILEGES;" | ${MYSQL_COMMAND_STRING}
}

function create_mysql_dd_qa_user {
  # Create a MySQL qa direct_delivery db user

  [ "${VERBOSE}" = true ] && printf '%s\n' "Generating MySQL qa direct_delivery user"

  verify_username

  PASSWORD=$(generate_mysql_password)
  printf '%s\n' "The password for MySQL qa direct_delivery is ${PASSWORD}"

  MYSQL_COMMAND_STRING="${MYSQL} --defaults-group-suffix=${MYSQL_QA_DD_SERVER_HOST} -h ${MYSQL_QA_DD_SERVER_HOST} -N"
  MYSQL_HASHED_PASSWORD=$(echo "select password('${PASSWORD}')" | ${MYSQL_COMMAND_STRING})

  echo "CREATE USER '${NEW_USERNAME}'@'%' IDENTIFIED BY PASSWORD '${MYSQL_HASHED_PASSWORD}';" | ${MYSQL_COMMAND_STRING}
  echo "GRANT SELECT, SHOW VIEW ON *.* TO '${NEW_USERNAME}'@'%';" | ${MYSQL_COMMAND_STRING}
  echo "FLUSH PRIVILEGES;" | ${MYSQL_COMMAND_STRING}
}

function create_mysql_ows_rds_prod_user {
  # Create a MySQL prod ows rds db user

  [ "${VERBOSE}" = true ] && printf '%s\n' "Generating MySQL prod ows rds user"

  verify_username

  PASSWORD=$(generate_mysql_password)
  printf '%s\n' "The password for MySQL prod ows rds hosts is ${PASSWORD}"

  for HOST in "${MYSQL_PROD_OWS_RDS_HOSTS[@]}"; do
    [ "${VERBOSE}" = true ] && printf '%s\n' "Generating mysql user on ${HOST}"

    MYSQL_COMMAND_STRING="${MYSQL} --defaults-group-suffix=${HOST} -h ${HOST} -N"
    MYSQL_HASHED_PASSWORD=$(echo "select password('${PASSWORD}')" | ${MYSQL_COMMAND_STRING})

    echo "CREATE USER '${NEW_USERNAME}'@'%' IDENTIFIED BY PASSWORD '${MYSQL_HASHED_PASSWORD}';" | ${MYSQL_COMMAND_STRING}
    echo "GRANT SELECT, SHOW VIEW ON *.* TO '${NEW_USERNAME}'@'%';" | ${MYSQL_COMMAND_STRING}
    echo "FLUSH PRIVILEGES;" | ${MYSQL_COMMAND_STRING}
  done
}

function create_mysql_ows_rds_qa_user {
  # Create a MySQL qa ows rds db user

  [ "${VERBOSE}" = true ] && printf '%s\n' "Generating MySQL qa ows rds user"

  verify_username

  PASSWORD=$(generate_mysql_password)
  printf '%s\n' "The password for MySQL qa ows rds is ${PASSWORD}"

  MYSQL_COMMAND_STRING="${MYSQL} --defaults-group-suffix=${MYSQL_QA_OWS_RDS_HOST} -h ${MYSQL_QA_OWS_RDS_HOST} -N"
  MYSQL_HASHED_PASSWORD=$(echo "select password('${PASSWORD}')" | ${MYSQL_COMMAND_STRING})

  echo "CREATE USER '${NEW_USERNAME}'@'%' IDENTIFIED BY PASSWORD '${MYSQL_HASHED_PASSWORD}';" | ${MYSQL_COMMAND_STRING}
  echo "GRANT SELECT, SHOW VIEW ON *.* TO '${NEW_USERNAME}'@'%';" | ${MYSQL_COMMAND_STRING}
  echo "FLUSH PRIVILEGES;" | ${MYSQL_COMMAND_STRING}

}

function create_mysql_rds_prod_user {
  # Create a MySQL user on an arbitrary Prod RDS instance with read privileges

  [ "${VERBOSE}" = true ] && printf '%s\n' "Generating MySQL prod rds user for ${RDS_PROD_DB}"

  verify_username

  PASSWORD=$(generate_mysql_password)
  printf '%s\n' "The password for MySQL ${RDS_PROD_DB} is ${PASSWORD}"
  # Guess the format for RDS dbs - probably won't work across other qa/prod accounts
  DB_HOST="prod-${RDS_PROD_DB}.cluster-cb22xqmk0y0q.${AWS_DEFAULT_REGION}.rds.amazonaws.com"

  MYSQL_COMMAND_STRING="${MYSQL} --defaults-group-suffix=${DB_HOST} -h ${DB_HOST} -N"
  MYSQL_HASHED_PASSWORD=$(echo "select password('${PASSWORD}')" | ${MYSQL_COMMAND_STRING})

  echo "CREATE USER '${NEW_USERNAME}'@'%' IDENTIFIED BY PASSWORD '${MYSQL_HASHED_PASSWORD}';" | ${MYSQL_COMMAND_STRING}
  echo "GRANT SELECT, SHOW VIEW ON ${RDS_PROD_DB//-/_}.* TO '${NEW_USERNAME}'@'%';" | ${MYSQL_COMMAND_STRING}
  echo "FLUSH PRIVILEGES;" | ${MYSQL_COMMAND_STRING}

}

function create_mysql_rds_qa_user {
  # Create a MySQL user on an arbitrary QA RDS instance with write privileges

  [ "${VERBOSE}" = true ] && printf '%s\n' "Generating MySQL qa rds user for ${RDS_QA_DB}"

  verify_username

  PASSWORD=$(generate_mysql_password)
  printf '%s\n' "The password for MySQL ${RDS_QA_DB} is ${PASSWORD}"
  # Guess the format for RDS dbs - probably won't work across other qa/prod accounts
  DB_HOST="qa-${RDS_QA_DB}.cluster-cb22xqmk0y0q.${AWS_DEFAULT_REGION}.rds.amazonaws.com"

  MYSQL_COMMAND_STRING="${MYSQL} --defaults-group-suffix=${DB_HOST} -h ${DB_HOST} -N"
  MYSQL_HASHED_PASSWORD=$(echo "select password('${PASSWORD}')" | ${MYSQL_COMMAND_STRING})

  echo "CREATE USER '${NEW_USERNAME}'@'%' IDENTIFIED BY PASSWORD '${MYSQL_HASHED_PASSWORD}';" | ${MYSQL_COMMAND_STRING}
  echo "GRANT ALL PRIVILEGES ON ${RDS_QA_DB//-/_}.* TO '${NEW_USERNAME}'@'%';" | ${MYSQL_COMMAND_STRING}
  echo "FLUSH PRIVILEGES;" | ${MYSQL_COMMAND_STRING}

}

function create_redshift_dev_user {
  # Create a Redshift dev user for typical use cases

  [ "${VERBOSE}" = true ] && printf '%s\n' "Generating Redshift dev user"

  verify_username

  PSQL_COMMAND_STRING="${PSQL} -h ${REDSHIFT_DEV_HOSTS} -d ${REDSHIFT_DEFAULT_DB} -p ${REDSHIFT_PORT}"

  if $(echo "select usename from pg_user;" | ${PSQL_COMMAND_STRING} | grep -i ${NEW_USERNAME} > /dev/null); then
    printf '%s\n' "${NEW_USERNAME} is already an active Redshift dev user. Skipping this step..."
  else
    PASSWORD=$(generate_password)
    printf '%s\n' "The password for Redshift dev is ${PASSWORD}"

    echo "create user ${NEW_USERNAME} password '${PASSWORD}';" | ${PSQL_COMMAND_STRING}
    echo "grant usage on schema staging to ${NEW_USERNAME};" | ${PSQL_COMMAND_STRING}
    echo "grant usage on schema production to ${NEW_USERNAME};" | ${PSQL_COMMAND_STRING}
    echo "alter user ${NEW_USERNAME} set search_path = production;" | ${PSQL_COMMAND_STRING}
    echo "alter group dw_queriers add user ${NEW_USERNAME}" | ${PSQL_COMMAND_STRING}
    echo "grant all on all tables in schema staging to ${NEW_USERNAME};" | ${PSQL_COMMAND_STRING}
    echo "grant all on all tables in schema production to ${NEW_USERNAME};" | ${PSQL_COMMAND_STRING}
    echo "alter user ${NEW_USERNAME} createuser;" | ${PSQL_COMMAND_STRING}

    printf '%s\n' "Redshift dev user created successfully"
  fi
}

function create_redshift_prod_user {
  # Create a Redshift prod user for read-only use cases.
  # All production clusters will have the same password.

  [ "${VERBOSE}" = true ] && printf '%s\n' "Generating Redshift prod user"

  verify_username

  PASSWORD=$(generate_password)
  printf '%s\n' "The password for Redshift prod is ${PASSWORD}"

  for HOST in "${REDSHIFT_PROD_HOSTS[@]}"; do
    [ "${VERBOSE}" = true ] && printf '%s\n' "Generating user on ${HOST}"

    PSQL_COMMAND_STRING="${PSQL} -h ${HOST} -d ${REDSHIFT_DEFAULT_DB} -p ${REDSHIFT_PORT}"

    if $(echo "select usename from pg_user;" | ${PSQL_COMMAND_STRING} | grep -i ${NEW_USERNAME} > /dev/null); then
      printf '%s\n' "${NEW_USERNAME} is already an active Redshift prod user on ${HOST}. Skipping this step..."
    else

      echo "create user ${NEW_USERNAME} password '${PASSWORD}';" | ${PSQL_COMMAND_STRING}
      echo "grant usage on schema qa to ${NEW_USERNAME};" | ${PSQL_COMMAND_STRING}
      echo "grant usage on schema staging to ${NEW_USERNAME};" | ${PSQL_COMMAND_STRING}
      echo "grant usage on schema production to ${NEW_USERNAME};" | ${PSQL_COMMAND_STRING}
      echo "alter user ${NEW_USERNAME} set search_path = production;" | ${PSQL_COMMAND_STRING}
      echo "alter group dw_queriers add user ${NEW_USERNAME}" | ${PSQL_COMMAND_STRING}
      echo "grant select on all tables in schema qa to ${NEW_USERNAME};" | ${PSQL_COMMAND_STRING}
      echo "grant select on all tables in schema staging to ${NEW_USERNAME};" | ${PSQL_COMMAND_STRING}
      echo "grant select on all tables in schema production to ${NEW_USERNAME};" | ${PSQL_COMMAND_STRING}

      printf '%s\n' "Redshift prod user created successfully"
    fi
  done
}

function create_snowflake_user {
  # Create a Snowflake user with grants only to default role as specified in global variable.

  [ "${VERBOSE}" = true ] && printf '%s\n' "Generating Snowflake user"

  verify_username

  PASSWORD=$(generate_complex_password)
  printf '%s\n' "The password for Snowflake is ${PASSWORD}"

  echo "CREATE USER ${NEW_USERNAME} display_name=${NEW_USERNAME} password='${PASSWORD}' default_warehouse = '${SNOWFLAKE_DEFAULT_WAREHOUSE}' default_role = '${SNOWFLAKE_DEFAULT_ROLE}' must_change_password = true;" | ${SNOWSQL}
  echo "GRANT ROLE ${SNOWFLAKE_DEFAULT_ROLE} TO USER ${NEW_USERNAME};" | ${SNOWSQL}
}

while getopts 'defhk:l:mnopqrstu:v' flag; do
  case "${flag}" in
  d) CREATE_MYSQL_DD_QA=true ;;
  e) CREATE_MYSQL_OWS_RDS_PROD=true ;;
  f) CREATE_MYSQL_OWS_RDS_QA=true ;;
  h) printf '%s\n'
     printf '%s\n' "This script automates the user creation process"
     printf '%s\n' "Specify services to be created with the following options:"
     printf '%s\n'
     printf '%s\n' "NB! AWS account management is now in Terraform"
     printf '%s\n'
     printf '%s\n' "-d: Create a MySQL user for QA direct_delivery"
     printf '%s\n' "-e: Create a read-only MySQL user for Prod ows RDS hosts"
     printf '%s\n' "-f: Create a read-only MySQL user for QA ows RDS hosts"
     printf '%s\n' "-h: Print this message"
     printf '%s\n' "-m: Create a MySQL user for squad dev dbs"
     printf '%s\n' "-n: Create a read-only MySQL user for reports_ar"
     printf '%s\n' "-o: Create a read-only MySQL user for reports_dd"
     printf '%s\n' "-p: Create a read-only Redshift user for production"
     printf '%s\n' "-q: Create a MySQL user for QA art_relations"
     printf '%s\n' "-r: Create a read-write Redshift user for dev"
     printf '%s\n' "-s: Create a Snowflake user with grants to default role"
     printf '%s\n'  "-t: Create a Mysql read only user for statementdb"
     printf '%s\n' "-u: The username to be created e.g. ./user_creation.sh -u some_user"
     printf '%s\n'
     printf '%s\n' "NOTE: this option must be specified first."
     printf '%s\n'
     printf '%s\n' "-v: Set verbose output"
     printf '%s\n'
     printf '%s\n' "Example: /user_creation.sh -u orcharduser -a -d -m -n"
     exit 0;;
  k) RDS_QA_DB="${OPTARG}" ;;
  l) RDS_PROD_DB="${OPTARG}" ;;
  m) CREATE_MYSQL_AR_DEV=true ;;
  n) CREATE_MYSQL_REPORTSAR=true ;;
  o) CREATE_MYSQL_REPORTSDD=true ;;
  p) CREATE_REDSHIFT_PROD=true ;;
  q) CREATE_MYSQL_AR_QA=true ;;
  r) CREATE_REDSHIFT_DEV=true ;;
  s) CREATE_SNOWFLAKE=true ;;
  t) CREATE_MYSQL_STATEMENTDB=true ;;
  u) NEW_USERNAME="${OPTARG}" ;;
  v) VERBOSE=true && printf '%s\n' "Verbose output enabled" ;;
  *) printf "Unexpected option ${flag}\n"
     exit 1 ;;
  esac
done

[ "${CREATE_MYSQL_DD_QA}" = true ] && create_mysql_dd_qa_user
[ "${CREATE_MYSQL_AR_DEV}" = true ] && create_mysql_ar_dev_user
[ "${CREATE_MYSQL_REPORTSAR}" = true ] && create_mysql_reportsar_user
[ "${CREATE_MYSQL_REPORTSDD}" = true ] && create_mysql_reportsdd_user
[ "${CREATE_MYSQL_STATEMENTDB}" = true ] && create_mysql_statementdb_user
[ "${CREATE_MYSQL_OWS_RDS_PROD}" = true ] && create_mysql_ows_rds_prod_user
[ "${CREATE_MYSQL_OWS_RDS_QA}" = true ] && create_mysql_ows_rds_qa_user
[ "${CREATE_REDSHIFT_PROD}" = true ] && create_redshift_prod_user
[ "${CREATE_MYSQL_AR_QA}" = true ] && create_mysql_ar_qa_user
[ "${CREATE_REDSHIFT_DEV}" = true ] && create_redshift_dev_user
[ "${CREATE_SNOWFLAKE}" = true ] && create_snowflake_user
[ -n "${RDS_QA_DB}" ] && create_mysql_rds_qa_user
[ -n "${RDS_PROD_DB}" ] && create_mysql_rds_prod_user