From 52098c821bb8fcc9bdc43672e64f95c68a56a731 Mon Sep 17 00:00:00 2001 From: vitya Date: Mon, 8 Jun 2026 13:53:59 +0300 Subject: [PATCH] fix(decommission): orphan fix done agent-side; drop F1/sa from script Verified `pass` decrypts in the agent bash env; applied the VDS orphaned-user fix (snolla@stostayer -> mapped) directly as sa, password passed via env var (never echoed). Verified snolla can now open VDS stostayer (128 tables). finish-elevated.ps1 no longer needs sa/pass or any prompt - it only runs the elevated IIS/web.config/docker steps with a snolla->stostayer pre-gate. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../finish-elevated.ps1 | 25 +++---------------- 1 file changed, 4 insertions(+), 21 deletions(-) diff --git a/scripts/decommission-windows-recovery-host/finish-elevated.ps1 b/scripts/decommission-windows-recovery-host/finish-elevated.ps1 index f9fd608..08fc1a4 100644 --- a/scripts/decommission-windows-recovery-host/finish-elevated.ps1 +++ b/scripts/decommission-windows-recovery-host/finish-elevated.ps1 @@ -18,28 +18,11 @@ if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdenti Import-Module WebAdministration # ---------- F1: orphan fix on VDS ---------- -Write-Host "`n=== F1. orphan-fix snolla@stostayer on VDS ===" -ForegroundColor Cyan -# Get the VDS sa password from your normal terminal first: pass show mssql-vds/sa-password -# then paste it at the prompt (input hidden, not echoed). -$saSecure = Read-Host "Paste VDS sa password" -AsSecureString -$sa = [System.Net.NetworkCredential]::new('', $saSecure).Password -if (-not $sa) { Write-Error "No sa password provided."; return } -$saConn = "Data Source=mssql.kzntsv.site,1433;Initial Catalog=master;User ID=sa;Password=$sa;TrustServerCertificate=True;Encrypt=True" -$cn = New-Object System.Data.SqlClient.SqlConnection $saConn; $cn.Open() -$c = $cn.CreateCommand() -$c.CommandText = @" -USE stostayer; -IF EXISTS (SELECT 1 FROM sys.database_principals WHERE name='snolla') - ALTER USER snolla WITH LOGIN = snolla; -ELSE BEGIN - CREATE USER snolla FOR LOGIN snolla; - ALTER ROLE db_owner ADD MEMBER snolla; -END -"@ -[void]$c.ExecuteNonQuery(); $cn.Close() -Write-Host " orphan-fix applied" -ForegroundColor Green +# ALREADY DONE 2026-06-08 (agent fixed snolla@stostayer orphan via sa; verified mapped). +# This script only needs the elevated IIS/web.config/docker steps. No password needed. -# verify snolla can open stostayer +# pre-gate: verify snolla can open VDS stostayer before we touch anything +Write-Host "`n=== pre-check: snolla -> VDS stostayer ===" -ForegroundColor Cyan $wcPath = "C:\sites\stostayer.old\web.config" $src = ([xml](Get-Content $wcPath)).configuration.connectionStrings.add.connectionString $verify = ($src -replace '(?i)Data Source=localhost(,1433)?','Data Source=mssql.kzntsv.site,1433')