fix: replica-ready probe must authenticate (clear leaked NOPASSWORD)

wait_until_replica_ready connects as the sandbox user, but init_slaves
exports NOPASSWORD=1 for the root steps and that leaked into the probe:
'use' then drops the password, so SELECT 1 fails with Access denied even
once the user exists, and the poll burned its full ~20s budget on every
replication deploy. Clear NOPASSWORD for the probe so it authenticates
and returns as soon as the replica is actually ready (~1-2s).

Author: renecannao

sandbox/templates/replication/init_slaves.gotxt

@@ -12,12 +12,16 @@ cd "$SBDIR"
 # initialization to prevent the race where the first client command on a
 # just-started replica fails with "Access denied" or connection errors.
 # Observed especially with MySQL 8.4+ and 9.x.
+# NOTE: init_slaves exports NOPASSWORD=1 for the root steps; that must NOT
+# leak into this probe, or 'use' would drop the sandbox-user password and the
+# check would fail with "Access denied" even once the user exists (burning the
+# whole budget). Clear NOPASSWORD for the probe so it authenticates normally.
 wait_until_replica_ready() {
     local use_cmd=${1:-$SBDIR/use}
     local max_attempts=${2:-20}
     local sleep_sec=${3:-1}
     for i in $(seq 1 $max_attempts); do
-        if $use_cmd -BN -e "SELECT 1;" >/dev/null 2>&1 ; then
+        if NOPASSWORD= $use_cmd -BN -e "SELECT 1;" >/dev/null 2>&1 ; then
             return 0
         fi
         sleep $sleep_sec

sandbox/templates/replication/init_slaves_84.gotxt

@@ -13,12 +13,16 @@ cd "$SBDIR"
 # initialization to prevent the race where the first client command on a
 # just-started replica fails with "Access denied" or connection errors.
 # Observed especially with MySQL 8.4+ and 9.x.
+# NOTE: init_slaves exports NOPASSWORD=1 for the root steps; that must NOT
+# leak into this probe, or 'use' would drop the sandbox-user password and the
+# check would fail with "Access denied" even once the user exists (burning the
+# whole budget). Clear NOPASSWORD for the probe so it authenticates normally.
 wait_until_replica_ready() {
     local use_cmd=${1:-$SBDIR/use}
     local max_attempts=${2:-20}
     local sleep_sec=${3:-1}
     for i in $(seq 1 $max_attempts); do
-        if $use_cmd -BN -e "SELECT 1;" >/dev/null 2>&1 ; then
+        if NOPASSWORD= $use_cmd -BN -e "SELECT 1;" >/dev/null 2>&1 ; then
             return 0
         fi
         sleep $sleep_sec

sandbox/templates/single/sb_include.gotxt

@@ -148,13 +148,17 @@ function wait_until_wsrep_ready
 # just-started replica fails with "Access denied" or connection errors.
 # Observed especially with MySQL 8.4+ and 9.x.
 # Usage: wait_until_replica_ready "$SBDIR/s1/use" 20 1
+# NOTE: callers (e.g. init_slaves) may export NOPASSWORD=1 for root steps; it
+# must not leak into this probe, or 'use' would drop the sandbox-user password
+# and the check would fail with "Access denied" even once the user exists.
+# Clear NOPASSWORD for the probe so it authenticates normally.
 function wait_until_replica_ready
 {
     local use_cmd=${1:-$SBDIR/use}
     local max_attempts=${2:-20}
     local sleep_sec=${3:-1}
     for i in $(seq 1 $max_attempts); do
-        if $use_cmd -BN -e "SELECT 1;" >/dev/null 2>&1 ; then
+        if NOPASSWORD= $use_cmd -BN -e "SELECT 1;" >/dev/null 2>&1 ; then
             return 0
         fi
         sleep $sleep_sec

sandbox/templates_flavor_test.go

@@ -245,6 +245,13 @@ func TestInitSlavesTemplates_IncludeReplicaReadyWait(t *testing.T) {
 		if !strings.Contains(result, expectedWarning) {
 			t.Errorf("%s template must include a timeout warning message", name)
 		}
+		// The probe must clear NOPASSWORD so it authenticates as the sandbox
+		// user. init_slaves exports NOPASSWORD=1 for the root steps; if it leaks
+		// into the probe, 'use' drops the password and the check fails with
+		// "Access denied" for the whole budget (~20s wasted on every deploy).
+		if !strings.Contains(result, `NOPASSWORD= $use_cmd -BN -e "SELECT 1;"`) {
+			t.Errorf("%s template must clear NOPASSWORD for the replica-ready probe", name)
+		}
 	}
 }
 
@@ -328,4 +335,9 @@ func TestSbInclude_WaitUntilReplicaReady_BoundedWait(t *testing.T) {
 		t.Errorf("wait_until_replica_ready max_attempts should be 20 to keep total wait ≤ %ds",
 			maxAllowedWaitSeconds)
 	}
+	// The probe must clear NOPASSWORD so it authenticates as the sandbox user
+	// (callers such as init_slaves export NOPASSWORD=1 for the root steps).
+	if !strings.Contains(result, `NOPASSWORD= $use_cmd -BN -e "SELECT 1;"`) {
+		t.Error("wait_until_replica_ready must clear NOPASSWORD for the probe, or it fails with Access denied and burns the whole budget")
+	}
 }