# SHOU-1 password migration (Phase 3)

Migrates legacy TripleDES passwords in `pal_User.password` to BCrypt hashes in `pal_UserPassword` for users with `customerCode = 'SHOU-1'`.

## Prerequisites

1. Run SQL scripts **in order** (you execute these — the tool does not):
   - `data/Scripts/SHOU-1/SHOU-1_3.0.01_create_pal_UserPassword_EVOL-1.sql` on the **central auth catalog** (default: `Framework_EVOL-1`)
   - `data/Scripts/SHOU-1/SHOU-1_3.0.02_create_pal_vUserPasswordShared.sql` on the **tenant catalog** (default: `Framework_SHOU-1`)

   Example (live):

   ```powershell
   sqlcmd -S localhost -d Framework_EVOL-1 -i data\Scripts\SHOU-1\SHOU-1_3.0.01_create_pal_UserPassword_EVOL-1.sql
   sqlcmd -S localhost -d Framework_SHOU-1 -v CentralCatalog="Framework_EVOL-1" -i data\Scripts\SHOU-1\SHOU-1_3.0.02_create_pal_vUserPasswordShared.sql
   ```

   Example (QA):

   ```powershell
   sqlcmd -S localhost -d Framework_EVOL-1_qa -i data\Scripts\SHOU-1\SHOU-1_3.0.01_create_pal_UserPassword_EVOL-1.sql
   sqlcmd -S localhost -d Framework_SHOU-1_qa -v CentralCatalog=Framework_EVOL-1_qa -i data\Scripts\SHOU-1\SHOU-1_3.0.02_create_pal_vUserPasswordShared.sql
   ```

   For full QA tenant isolation (auth views + cross-DB remediation), use:

   ```powershell
   .\data\Scripts\SHOU-1\deploy-qa-tenant-db.ps1 -Server localhost -TenantCatalog Framework_SHOU-1_qa -CentralCatalog Framework_EVOL-1_qa
   ```

   Cross-catalog scripts require `-v CentralCatalog=<name>` (no default in script files).

2. Deploy Phase 3 `framework_business.dll` to the site `Bin/` (build `business` project).
3. Repo-root `.env` with:
   - `DB_CONNECTION_STRING` pointing at the tenant catalog (e.g. `Framework_SHOU-1`)
   - `DB_LIVE_CONNECTION_STRING` pointing at the central auth catalog (e.g. `Framework_EVOL-1`)

## Build

```powershell
msbuild tools\password-migrate\password-migrate.csproj /p:Configuration=Release
```

Or build `business` first, then the migrate project in Visual Studio.

## Run

Dry run (no writes):

```powershell
tools\password-migrate\bin\Release\password-migrate.exe --dry-run
```

Live migration:

```powershell
tools\password-migrate\bin\Release\password-migrate.exe
```

## After smoke tests

Run `data/Scripts/SHOU-1/SHOU-1_3.0.03_null_legacy_passwords_SHOU-1.sql` to clear legacy `pal_User.password` for migrated SHOU-1 users:

```powershell
sqlcmd -S localhost -d master -v CentralCatalog="Framework_EVOL-1" -i data\Scripts\SHOU-1\SHOU-1_3.0.03_null_legacy_passwords_SHOU-1.sql
```

## Deploy order summary

1. SQL 3.0.01 + 3.0.02 (use `-v CentralCatalog=...` for cross-catalog view scripts)
2. Deploy application DLLs
3. Migration tool (this)
4. Smoke test login / register / reset / admin
5. SQL 3.0.03 (optional cleanup)