docs: inbound API key store — shared SQL Server provider on central pairs (spec, runbook + central-pairs procedure, DBA DDL copy, topology, env inventory, CLAUDE.md, register row 108 closed with rig proof, row 109 Secrets backoff follow-up, Delmia spec §8)

Claude-Session: https://claude.ai/code/session_013L3XdmVii9i5sY4FChU8pB
2026-09-02 23:31:21 -04:00
parent a83cc8613d
commit f47ceb55b1
11 changed files with 1004 additions and 12 deletions
@@ -0,0 +1,73 @@
+-- Copy of ZB.MOM.WW.Auth's docs/sql/zbauth-schema.sql as shipped in library version 0.3.0.
+-- Original lives at ~/Desktop/scadaproj/ZB.MOM.WW.Auth/docs/sql/zbauth-schema.sql — if the two
+-- drift, that repo is authoritative; re-copy it here rather than editing this file independently.
+
+-- ZB.MOM.WW.Auth.ApiKeys.SqlServer — shared API-key schema, version 1.
+--
+-- For DBAs whose application login lacks DDL rights. The host normally provisions this itself at
+-- startup (SqlServerApiKeyStoreMigrator, which runs the identical statements and is safe to run
+-- concurrently from every node); where the app login may only read and write rows, run this script
+-- once against the target database instead. The migrator then finds the version row already at the
+-- version it supports and does nothing further beyond re-stamping applied_utc.
+--
+-- The schema name is hard-coded to zbauth here — the default of SqlServerApiKeyOptions.Schema. If a
+-- deployment overrides that option, substitute the name in every bracketed identifier below.
+--
+-- Kept byte-for-byte consistent with SqlServerAuthSchema.CreateSchemaDdl apart from that
+-- substitution and the literal version row at the end; change both together.
+
+IF NOT EXISTS (SELECT 1 FROM sys.schemas WHERE name = N'zbauth')
+    EXEC(N'CREATE SCHEMA [zbauth]');
+
+IF OBJECT_ID(N'[zbauth].[schema_version]', N'U') IS NULL
+    CREATE TABLE [zbauth].[schema_version] (
+        id          INT               NOT NULL CONSTRAINT PK_zbauth_schema_version PRIMARY KEY CHECK (id = 1),
+        version     INT               NOT NULL,
+        applied_utc DATETIMEOFFSET(7) NOT NULL
+    );
+
+IF OBJECT_ID(N'[zbauth].[api_keys]', N'U') IS NULL
+    CREATE TABLE [zbauth].[api_keys] (
+        key_id        NVARCHAR(64)      NOT NULL CONSTRAINT PK_zbauth_api_keys PRIMARY KEY,
+        key_prefix    NVARCHAR(16)      NOT NULL,
+        secret_hash   VARBINARY(64)     NOT NULL,
+        display_name  NVARCHAR(256)     NOT NULL,
+        scopes        NVARCHAR(MAX)     NOT NULL,
+        constraints   NVARCHAR(MAX)     NULL,
+        created_utc   DATETIMEOFFSET(7) NOT NULL,
+        last_used_utc DATETIMEOFFSET(7) NULL,
+        revoked_utc   DATETIMEOFFSET(7) NULL,
+        expires_utc   DATETIMEOFFSET(7) NULL
+    );
+
+IF OBJECT_ID(N'[zbauth].[api_key_audit]', N'U') IS NULL
+    CREATE TABLE [zbauth].[api_key_audit] (
+        audit_id       BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_zbauth_api_key_audit PRIMARY KEY,
+        key_id         NVARCHAR(64)      NULL,
+        event_type     NVARCHAR(64)      NOT NULL,
+        remote_address NVARCHAR(64)      NULL,
+        created_utc    DATETIMEOFFSET(7) NOT NULL,
+        details        NVARCHAR(MAX)     NULL
+    );
+
+IF NOT EXISTS (
+    SELECT 1 FROM sys.indexes
+    WHERE name = N'ix_api_keys_revoked_utc'
+      AND object_id = OBJECT_ID(N'[zbauth].[api_keys]'))
+    CREATE INDEX ix_api_keys_revoked_utc
+        ON [zbauth].[api_keys] (revoked_utc);
+
+IF NOT EXISTS (
+    SELECT 1 FROM sys.indexes
+    WHERE name = N'ix_api_key_audit_key_id_created_utc'
+      AND object_id = OBJECT_ID(N'[zbauth].[api_key_audit]'))
+    CREATE INDEX ix_api_key_audit_key_id_created_utc
+        ON [zbauth].[api_key_audit] (key_id, created_utc);
+
+MERGE [zbauth].[schema_version] AS target
+USING (SELECT 1 AS id, 1 AS version, SYSDATETIMEOFFSET() AS applied_utc) AS source
+    ON target.id = source.id
+WHEN MATCHED THEN
+    UPDATE SET version = source.version, applied_utc = source.applied_utc
+WHEN NOT MATCHED THEN
+    INSERT (id, version, applied_utc) VALUES (1, source.version, source.applied_utc);