Improve certificate path probing with demo UNC target and remove Sonic container scan.

Co-authored-by: Cursor <cursoragent@cursor.com>

ZA.CoreService.ESBCertificateManager/Database/03_Seed.sql

@@ -268,12 +268,35 @@ BEGIN
         1;
 END;
 
+/* Demo-Pfad für Zertifikat-Austausch (UNC server.p12) – immer sicherstellen */
+DECLARE @DemoDirectory [nvarchar](500) =
+    N'\\dekun-painwbdet\e$\proalpha-inwb\test\Containers\proalpha-test.ct-ZADBService\certs';
+DECLARE @DemoFileName [nvarchar](260) = N'server.p12';
+
+UPDATE [dbo].[CertificateTarget]
+SET
+    [TargetDirectory] = @DemoDirectory,
+    [TargetFileName] = @DemoFileName,
+    [BackupEnabled] = 1,
+    [BackupDirectoryName] = N'Backup',
+    [IsActive] = 1,
+    [ModifiedDateTime] = SYSUTCDATETIME(),
+    [ModifiedBy] = SUSER_SNAME()
+WHERE [SonicContainerId] = @SonicContainerId
+  AND
+  (
+      [TargetFileName] IN (N'server.crt', N'server.p12')
+      OR [TargetDirectory] LIKE N'C:\ESB\Certificates%'
+  );
+
 IF NOT EXISTS
 (
     SELECT 1
     FROM [dbo].[CertificateTarget] AS target
     WHERE target.[SonicContainerId] = @SonicContainerId
-      AND target.[TargetFileName] = N'server.crt'
+      AND target.[TargetDirectory] = @DemoDirectory
+      AND target.[TargetFileName] = @DemoFileName
+      AND target.[IsActive] = 1
 )
 BEGIN
     INSERT INTO [dbo].[CertificateTarget]
@@ -290,8 +313,8 @@ BEGIN
     VALUES
     (
         @SonicContainerId,
-        N'C:\ESB\Certificates',
-        N'server.crt',
+        @DemoDirectory,
+        @DemoFileName,
         1,
         N'Backup',
         1,

ZA.CoreService.ESBCertificateManager/Database/04_EnsureDemoPath.sql

@@ -0,0 +1,106 @@
+/*
+COMMENT:     Stellt den Demo-Zertifikatspfad für DE-Test / ct-ZADBService sicher.
+             Kann allein gegen eine bestehende EsbZertifikatManager-DB laufen
+             (ohne Drop/Create). EnvironmentCode muss TEST sein (appsettings).
+*/
+USE [EsbZertifikatManager];
+GO
+
+SET NOCOUNT ON;
+SET XACT_ABORT ON;
+
+DECLARE @SonicContainerId [int];
+DECLARE @TargetDirectory [nvarchar](500) =
+    N'\\dekun-painwbdet\e$\proalpha-inwb\test\Containers\proalpha-test.ct-ZADBService\certs';
+DECLARE @TargetFileName [nvarchar](260) = N'server.p12';
+
+SELECT @SonicContainerId = container.[SonicContainerId]
+FROM [dbo].[SonicContainer] AS container
+INNER JOIN [dbo].[SonicConnection] AS connection
+    ON connection.[SonicConnectionId] = container.[SonicConnectionId]
+INNER JOIN [dbo].[Environment] AS environment
+    ON environment.[EnvironmentId] = connection.[EnvironmentId]
+WHERE environment.[EnvironmentCode] = N'TEST'
+  AND connection.[ConnectionName] = N'DE-Test'
+  AND container.[ContainerName] = N'ct-ZADBService';
+
+IF @SonicContainerId IS NULL
+BEGIN
+    THROW 50010,
+        N'Demo-Pfad: Container ct-ZADBService / DE-Test / TEST nicht gefunden. Zuerst 03_Seed.sql ausführen.',
+        1;
+END;
+
+/* Alte Platzhalter am gleichen Container auf Demo-Pfad umbiegen */
+UPDATE [dbo].[CertificateTarget]
+SET
+    [TargetDirectory] = @TargetDirectory,
+    [TargetFileName] = @TargetFileName,
+    [BackupEnabled] = 1,
+    [BackupDirectoryName] = N'Backup',
+    [IsActive] = 1,
+    [ModifiedDateTime] = SYSUTCDATETIME(),
+    [ModifiedBy] = SUSER_SNAME()
+WHERE [SonicContainerId] = @SonicContainerId
+  AND
+  (
+      [TargetFileName] IN (N'server.crt', N'server.p12')
+      OR [TargetDirectory] LIKE N'C:\ESB\Certificates%'
+  );
+
+IF NOT EXISTS
+(
+    SELECT 1
+    FROM [dbo].[CertificateTarget] AS target
+    WHERE target.[SonicContainerId] = @SonicContainerId
+      AND target.[TargetDirectory] = @TargetDirectory
+      AND target.[TargetFileName] = @TargetFileName
+      AND target.[IsActive] = 1
+)
+BEGIN
+    INSERT INTO [dbo].[CertificateTarget]
+    (
+        [SonicContainerId],
+        [TargetDirectory],
+        [TargetFileName],
+        [BackupEnabled],
+        [BackupDirectoryName],
+        [IsActive],
+        [CreationDateTime],
+        [CreatedBy]
+    )
+    VALUES
+    (
+        @SonicContainerId,
+        @TargetDirectory,
+        @TargetFileName,
+        1,
+        N'Backup',
+        1,
+        SYSUTCDATETIME(),
+        SUSER_SNAME()
+    );
+END;
+
+SELECT
+    target.[CertificateTargetId],
+    company.[CompanyCode],
+    environment.[EnvironmentCode],
+    connection.[ConnectionName],
+    container.[ContainerName],
+    target.[TargetDirectory],
+    target.[TargetFileName],
+    target.[IsActive]
+FROM [dbo].[CertificateTarget] AS target
+INNER JOIN [dbo].[SonicContainer] AS container
+    ON container.[SonicContainerId] = target.[SonicContainerId]
+INNER JOIN [dbo].[SonicConnection] AS connection
+    ON connection.[SonicConnectionId] = container.[SonicConnectionId]
+INNER JOIN [dbo].[Environment] AS environment
+    ON environment.[EnvironmentId] = connection.[EnvironmentId]
+INNER JOIN [dbo].[Company] AS company
+    ON company.[CompanyId] = container.[CompanyId]
+WHERE container.[SonicContainerId] = @SonicContainerId;
+
+PRINT N'Demo-Pfad ist aktiv: \\dekun-painwbdet\e$\...\certs\server.p12';
+GO

ZA.CoreService.ESBCertificateManager/Database/README.md

@@ -32,9 +32,20 @@ cd Database\AlwaysEncrypted
 | Environment | TEST2, TEST, PROD |
 | SonicConnection | DE-Test → `tcp://dekun-painwbdet:13070`, Domain `proalpha-test`, Env TEST |
 | SonicContainer | ct-ZADBService (Company DE) |
-| CertificateTarget | `C:\ESB\Certificates\server.crt` (Platzhalter) |
+| CertificateTarget | Demo-UNC `\\dekun-painwbdet\e$\...\certs\server.p12` |
 | SonicCredential | **nicht** geseedet (Setup-Wizard / AE) |
 
+## Demo-Pfad nachziehen (bestehende DB)
+
+Wenn der alte Platzhalter noch in SQL liegt:
+
+```text
+04_EnsureDemoPath.sql
+```
+
+Zusätzlich: in `appsettings.json` ist `"Demo": { "Enabled": true, ... }` –
+die App zeigt den Demo-Pfad auch ohne SQL-Update in der Zielliste (Kopieren testen).
+
 ## Always Encrypted
 
 | Objekt | Name |