feat(tplus): 新增同步暂存与任务管理迁移和环境配置

scripts/tplus/create_tplus_readonly_login.ps1

@@ -0,0 +1,56 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$DatabaseName,
+    [string]$LoginName = "tplus_reader",
+    [string]$ContainerName = "ys-tplus-sqlserver-dev",
+    [Parameter(Mandatory = $true)]
+    [SecureString]$SaPassword,
+    [Parameter(Mandatory = $true)]
+    [SecureString]$ReaderPassword
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = "Stop"
+. (Join-Path $PSScriptRoot "container_sql.ps1")
+
+function Convert-SecureStringToPlainText([SecureString]$Value) {
+    $ptr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($Value)
+    try { return [Runtime.InteropServices.Marshal]::PtrToStringBSTR($ptr) }
+    finally { [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ptr) }
+}
+
+if ($LoginName -notmatch '^[A-Za-z_][A-Za-z0-9_]{0,63}$') {
+    throw "只读账号名只能包含字母、数字和下划线，且不能以数字开头。"
+}
+
+$readerPasswordText = Convert-SecureStringToPlainText $ReaderPassword
+$safeDatabaseIdentifier = $DatabaseName.Replace("]", "]]" )
+$safeDatabaseLiteral = $DatabaseName.Replace("'", "''")
+$safeLoginIdentifier = $LoginName.Replace("]", "]]" )
+$safeReaderPassword = $readerPasswordText.Replace("'", "''")
+$sql = @"
+IF DATABASEPROPERTYEX(N'$safeDatabaseLiteral', 'Updateability') = N'READ_ONLY'
+    ALTER DATABASE [$safeDatabaseIdentifier] SET READ_WRITE;
+IF NOT EXISTS (SELECT 1 FROM sys.server_principals WHERE name = N'$safeLoginIdentifier')
+BEGIN
+    CREATE LOGIN [$safeLoginIdentifier] WITH PASSWORD = N'$safeReaderPassword', CHECK_POLICY = ON;
+END;
+USE [$safeDatabaseIdentifier];
+IF NOT EXISTS (SELECT 1 FROM sys.database_principals WHERE name = N'$safeLoginIdentifier')
+BEGIN
+    CREATE USER [$safeLoginIdentifier] FOR LOGIN [$safeLoginIdentifier];
+END;
+IF NOT EXISTS (
+    SELECT 1 FROM sys.database_role_members rm
+    JOIN sys.database_principals r ON r.principal_id = rm.role_principal_id
+    JOIN sys.database_principals u ON u.principal_id = rm.member_principal_id
+    WHERE r.name=N'db_datareader' AND u.name=N'$safeLoginIdentifier'
+)
+    EXEC sp_addrolemember N'db_datareader', N'$safeLoginIdentifier';
+DENY INSERT, UPDATE, DELETE TO [$safeLoginIdentifier];
+ALTER DATABASE [$safeDatabaseIdentifier] SET READ_ONLY;
+"@
+
+Invoke-TPlusContainerSql -ContainerName $ContainerName -Sql $sql -SaPassword $SaPassword
+Write-Host "只读账号已配置：$LoginName（未输出密码）"