-- Least-privilege grants for collector on each SQL Server target
-- Run on monitored instances (not the repository). Replace login name as needed.

USE master;
GO

IF NOT EXISTS (SELECT 1 FROM sys.server_principals WHERE name = N'dbaops_collector')
BEGIN
  CREATE LOGIN [dbaops_collector] FROM WINDOWS; -- or FROM PASSWORD = '...' for SQL auth
END
GO

IF NOT EXISTS (SELECT 1 FROM sys.server_principals WHERE name = N'dbaops_collector')
  THROW 50001, 'Create login dbaops_collector (Windows or SQL) before applying grants.', 1;
GO

GRANT VIEW SERVER STATE TO [dbaops_collector];
GRANT VIEW ANY DEFINITION TO [dbaops_collector];
GRANT CONNECT SQL TO [dbaops_collector];
GO

-- Optional per-database read for inventory (repeat per user database)
-- USE [YourDatabase];
-- CREATE USER [dbaops_collector] FOR LOGIN [dbaops_collector];
-- GRANT VIEW DATABASE STATE TO [dbaops_collector];
