57 lines
2.3 KiB
PowerShell
57 lines
2.3 KiB
PowerShell
[CmdletBinding()]
|
|
param(
|
|
[Parameter(Mandatory = $true)]
|
|
[string]$DatabaseName,
|
|
[string]$LoginName = "tplus_reader",
|
|
[string]$ContainerName = "ys-tplus-sqlserver-dev",
|
|
[Parameter(Mandatory = $true)]
|
|
[SecureString]$SaPassword,
|
|
[Parameter(Mandatory = $true)]
|
|
[SecureString]$ReaderPassword
|
|
)
|
|
|
|
Set-StrictMode -Version Latest
|
|
$ErrorActionPreference = "Stop"
|
|
. (Join-Path $PSScriptRoot "container_sql.ps1")
|
|
|
|
function Convert-SecureStringToPlainText([SecureString]$Value) {
|
|
$ptr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($Value)
|
|
try { return [Runtime.InteropServices.Marshal]::PtrToStringBSTR($ptr) }
|
|
finally { [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ptr) }
|
|
}
|
|
|
|
if ($LoginName -notmatch '^[A-Za-z_][A-Za-z0-9_]{0,63}$') {
|
|
throw "只读账号名只能包含字母、数字和下划线，且不能以数字开头。"
|
|
}
|
|
|
|
$readerPasswordText = Convert-SecureStringToPlainText $ReaderPassword
|
|
$safeDatabaseIdentifier = $DatabaseName.Replace("]", "]]" )
|
|
$safeDatabaseLiteral = $DatabaseName.Replace("'", "''")
|
|
$safeLoginIdentifier = $LoginName.Replace("]", "]]" )
|
|
$safeReaderPassword = $readerPasswordText.Replace("'", "''")
|
|
$sql = @"
|
|
IF DATABASEPROPERTYEX(N'$safeDatabaseLiteral', 'Updateability') = N'READ_ONLY'
|
|
ALTER DATABASE [$safeDatabaseIdentifier] SET READ_WRITE;
|
|
IF NOT EXISTS (SELECT 1 FROM sys.server_principals WHERE name = N'$safeLoginIdentifier')
|
|
BEGIN
|
|
CREATE LOGIN [$safeLoginIdentifier] WITH PASSWORD = N'$safeReaderPassword', CHECK_POLICY = ON;
|
|
END;
|
|
USE [$safeDatabaseIdentifier];
|
|
IF NOT EXISTS (SELECT 1 FROM sys.database_principals WHERE name = N'$safeLoginIdentifier')
|
|
BEGIN
|
|
CREATE USER [$safeLoginIdentifier] FOR LOGIN [$safeLoginIdentifier];
|
|
END;
|
|
IF NOT EXISTS (
|
|
SELECT 1 FROM sys.database_role_members rm
|
|
JOIN sys.database_principals r ON r.principal_id = rm.role_principal_id
|
|
JOIN sys.database_principals u ON u.principal_id = rm.member_principal_id
|
|
WHERE r.name=N'db_datareader' AND u.name=N'$safeLoginIdentifier'
|
|
)
|
|
EXEC sp_addrolemember N'db_datareader', N'$safeLoginIdentifier';
|
|
DENY INSERT, UPDATE, DELETE TO [$safeLoginIdentifier];
|
|
ALTER DATABASE [$safeDatabaseIdentifier] SET READ_ONLY;
|
|
"@
|
|
|
|
Invoke-TPlusContainerSql -ContainerName $ContainerName -Sql $sql -SaPassword $SaPassword
|
|
Write-Host "只读账号已配置：$LoginName（未输出密码）"
|