dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 15 Pull Requests Actions Packages Projects Releases Wiki Activity

AuditLog two-login hardening: partition roll-forward and SourceNode backfill still use the runtime login #113

New Issue
Closed
opened 2026-11-09 23:32:36 -05:00 by dohertj2 · 1 comment
dohertj2 commented 2026-11-09 23:32:36 -05:00
Owner
Copy Link
Copy Source

Follow-up from #107 item 3 (c4d7ec9b). With AuditLog:MaintenanceConnectionString set, the chain job, verify/head export, partition switch-out + archive and per-channel purge run on the maintenance login. Two maintenance-type paths still run on the runtime (writer) login:

  • Monthly partition roll-forward (AuditLogPartitionMaintenance, ALTER PARTITION FUNCTION … SPLIT RANGE) — needs ALTER ANY DATASPACE (or ownership of pf_AuditLog_Month/ps_AuditLog_Month) on the runtime login in a hardened setup, or a DBA job.
  • audit backfill-source-node — an UPDATE (SourceNode) on dbo.AuditLog; the writer role's DENY UPDATE blocks it, and neither chainer nor purger has it. Today it must be run by a DBA-privileged principal.

Decide whether to (a) move roll-forward onto AuditMaintenanceContext and grant the purger role the partition-function rights in a migration, and (b) give the backfill its own grant/role or document it as a DBA-only step. Documented as-is in Component-AuditLog.md (Two-login hardening).

Follow-up from #107 item 3 (`c4d7ec9b`). With `AuditLog:MaintenanceConnectionString` set, the chain job, verify/head export, partition switch-out + archive and per-channel purge run on the maintenance login. Two maintenance-type paths still run on the runtime (writer) login: - **Monthly partition roll-forward** (`AuditLogPartitionMaintenance`, `ALTER PARTITION FUNCTION … SPLIT RANGE`) — needs `ALTER ANY DATASPACE` (or ownership of `pf_AuditLog_Month`/`ps_AuditLog_Month`) on the runtime login in a hardened setup, or a DBA job. - **`audit backfill-source-node`** — an `UPDATE (SourceNode)` on `dbo.AuditLog`; the writer role's `DENY UPDATE` blocks it, and neither chainer nor purger has it. Today it must be run by a DBA-privileged principal. Decide whether to (a) move roll-forward onto `AuditMaintenanceContext` and grant the purger role the partition-function rights in a migration, and (b) give the backfill its own grant/role or document it as a DBA-only step. Documented as-is in Component-AuditLog.md (Two-login hardening).
dohertj2 added the type:followuppriority:p3 labels 2026-11-09 23:32:36 -05:00
dohertj2 commented 2026-11-09 23:48:05 -05:00
Author
Owner
Copy Link
Copy Source

Fixed in 533414a1 (main). AuditLogPartitionMaintenance (roll-forward) and the backfill-source-node endpoint now run on AuditMaintenanceContext / the keyed maintenance repository when AuditLog:MaintenanceConnectionString is set (unset = unchanged). New migration AuditMaintenanceGrants grants scadabridge_audit_purger ALTER ANY DATASPACE (ALTER ON SCHEMA::dbo does not cover SPLIT RANGE) and column-level UPDATE (SourceNode) on dbo.AuditLog; documented in Component-AuditLog.md (Two-login hardening). Evidence: AuditMaintenanceLoginTests.RollForwardAndSourceNodeBackfill_RunOnTheMaintenanceLogin_NotTheWriter on local scadabridge-mssql, with writer-login negative controls (both refused); mutation-proved (dropping either grant, or building roll-forward on the runtime context, fails it). Migration NOT applied anywhere (no deploys).

Fixed in 533414a1 (main). AuditLogPartitionMaintenance (roll-forward) and the backfill-source-node endpoint now run on AuditMaintenanceContext / the keyed maintenance repository when AuditLog:MaintenanceConnectionString is set (unset = unchanged). New migration AuditMaintenanceGrants grants scadabridge_audit_purger ALTER ANY DATASPACE (ALTER ON SCHEMA::dbo does not cover SPLIT RANGE) and column-level UPDATE (SourceNode) on dbo.AuditLog; documented in Component-AuditLog.md (Two-login hardening). Evidence: AuditMaintenanceLoginTests.RollForwardAndSourceNodeBackfill_RunOnTheMaintenanceLogin_NotTheWriter on local scadabridge-mssql, with writer-login negative controls (both refused); mutation-proved (dropping either grant, or building roll-forward on the runtime context, fails it). Migration NOT applied anywhere (no deploys).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
blocked
Blocked by dependency or external hold
 cross-repo
Needs coordinated change in another family repo (wire contract etc.)
 migrated
Migrated from a markdown backlog (2026-11 standardization)
 priority:p0
Must-have / blocking
 priority:p1
High priority
 priority:p2
Normal priority
 priority:p3
Low priority / nice to have
 type:bug
Defect in shipped behaviour
 type:debt
Technical debt / hygiene
 type:deploy-gate
Rollout/deploy/migration step not yet done on an environment
 type:docs
Documentation work
 type:feature
Feature implementation
 type:followup
Follow-up deferred from a plan, PR or gate
 type:infra
Infrastructure and scaffolding
 type:review-finding
Unfixed finding from an architecture/code review
 type:test
Test work
No Label priority:p3 type:followup
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dohertj2 (dohertj2)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dohertj2/ScadaBridge#113
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?