<#
  finish-elevated.ps1 - final decommission of windows-recovery-host.
  RUN IN AN ELEVATED PowerShell (Run as Administrator).
  Requires working `pass` (gpg-agent) for the VDS sa password.

  Steps (with a safety gate):
    F1. Fix orphaned user `snolla` in DB `stostayer` on mssql.kzntsv.site.
    F2. Repoint stostayer.old web.config localhost -> mssql.kzntsv.site (+backup).
    F3. Restart stostayer.old pool, smoke :8091. If 5xx -> STOP, do NOT touch MSSQL.
    E.  Remove IIS site snolla + C:\sites\snolla.
    M.  Remove local MSSQL (docker) + volume + data dir (~30 GB).
  Idempotent - safe to re-run. ASCII-only on purpose (PS 5.1 codepage safety).
#>
$ErrorActionPreference = 'Stop'
if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator)) {
  Write-Error "Need an elevated shell (Run as Administrator)."; return
}
Import-Module WebAdministration

# ---------- F1: orphan fix on VDS ----------
# ALREADY DONE 2026-06-08 (agent fixed snolla@stostayer orphan via sa; verified mapped).
# This script only needs the elevated IIS/web.config/docker steps. No password needed.

# pre-gate: verify snolla can open VDS stostayer before we touch anything
Write-Host "`n=== pre-check: snolla -> VDS stostayer ===" -ForegroundColor Cyan
$wcPath = "C:\sites\stostayer.old\web.config"
$src = ([xml](Get-Content $wcPath)).configuration.connectionStrings.add.connectionString
$verify = ($src -replace '(?i)Data Source=localhost(,1433)?','Data Source=mssql.kzntsv.site,1433')
if ($verify -notmatch 'TrustServerCertificate') { $verify = $verify.TrimEnd(';') + ';TrustServerCertificate=True' }
$cn = New-Object System.Data.SqlClient.SqlConnection $verify; $cn.Open()
$c = $cn.CreateCommand(); $c.CommandText = "SELECT DB_NAME()"; $db = $c.ExecuteScalar(); $cn.Close()
Write-Host "  verify snolla->VDS stostayer OK (db=$db)" -ForegroundColor Green

# ---------- F2: repoint web.config (idempotent) ----------
Write-Host "`n=== F2. repoint stostayer.old web.config ===" -ForegroundColor Cyan
if ($src -match '(?i)Data Source=localhost') {
  Copy-Item $wcPath "$wcPath.bak-pre-vds-$(Get-Date -Format yyyyMMdd)" -Force
  $xml = [xml](Get-Content $wcPath)
  $node = $xml.configuration.connectionStrings.add | Where-Object { $_.name -eq 'MoreThenCmsEntities' }
  $new = ($node.connectionString -replace '(?i)Data Source=localhost(,1433)?','Data Source=mssql.kzntsv.site,1433')
  if ($new -notmatch 'TrustServerCertificate') { $new = $new.TrimEnd(';') + ';TrustServerCertificate=True' }
  $node.connectionString = $new
  $xml.Save($wcPath)
  Write-Host "  web.config -> mssql.kzntsv.site (backup alongside)" -ForegroundColor Green
} else { Write-Host "  already pointed at VDS - skip (original backup preserved)" -ForegroundColor Green }

# ---------- F3: restart pool + smoke (proxy-bypassed) ----------
Write-Host "`n=== F3. restart pool stostayer.old + smoke :8091 ===" -ForegroundColor Cyan
Restart-WebAppPool -Name 'stostayer.old'
Start-Sleep -Seconds 5
# system VPN proxy swallows localhost (wiki bug #7) -> curl.exe --noproxy bypasses it
$code = (& curl.exe -s -o NUL -w "%{http_code}" --noproxy "*" --max-time 30 http://localhost:8091/)
Write-Host "  :8091 -> HTTP $code"
if ((-not ($code -match '^\d+$')) -or ([int]$code -eq 0) -or ([int]$code -ge 500)) {
  Write-Error "stostayer.old returned '$code' - repoint FAILED. Leaving MSSQL untouched. Rollback: restore web.config.bak-pre-vds-*."
  return
}
Write-Host "  stostayer.old is alive on the VDS DB" -ForegroundColor Green

# ---------- E: snolla source IIS teardown ----------
Write-Host "`n=== E. remove IIS site snolla + content ===" -ForegroundColor Cyan
if (Get-Website -Name snolla -ErrorAction SilentlyContinue) {
  Stop-Website -Name snolla -ErrorAction SilentlyContinue
  Remove-Website -Name snolla
  Write-Host "  IIS site snolla removed"
}
if (Get-WebAppPoolState -Name snolla -ErrorAction SilentlyContinue) { Remove-WebAppPool -Name snolla; Write-Host "  app pool snolla removed" }
# (local traefik already removed 2026-06-08 - no CMS routes to clean)
if (Test-Path "C:\sites\snolla") { Remove-Item "C:\sites\snolla" -Recurse -Force; Write-Host "  C:\sites\snolla removed (8.66 GB)" -ForegroundColor Green }

# ---------- M: local MSSQL teardown ----------
Write-Host "`n=== M. remove local MSSQL ===" -ForegroundColor Cyan
$ErrorActionPreference = 'Continue'   # native docker stderr must not abort here
docker stop mssql 2>$null | Out-Null
docker rm mssql 2>$null | Out-Null
docker volume rm mssql_mssql_data 2>$null | Out-Null
$mssqlDir = "C:\Users\vitya\projects\docker\diskstation\mssql"
if (Test-Path $mssqlDir) { Remove-Item $mssqlDir -Recurse -Force; Write-Host "  diskstation/mssql removed (~28 GB)" -ForegroundColor Green }

Write-Host "`n=== DONE. Free C: ===" -ForegroundColor Cyan
Get-PSDrive C | ForEach-Object { "Free={0:N0}GB" -f ($_.Free/1GB) }
Write-Host "`nSeparately (when convenient) - compact the docker WSL vhdx to return ~176 GB to C::"
Write-Host '  wsl --shutdown'
Write-Host '  Get-ChildItem $env:LOCALAPPDATA\Docker\wsl -Recurse -Filter *.vhdx   # find the path'
Write-Host '  Optimize-VHD -Path <docker_data.vhdx> -Mode Full   # needs Hyper-V module; else diskpart compact vdisk'