feat(auth.apikeys.sqlserver): zbauth schema v1 + concurrent-boot-safe migrator (retry on 1205/2714/1913/2627, newer-version fail-closed); live tests gated on AUTH_SQLSERVER_CONNSTR

Claude-Session: https://claude.ai/code/session_013L3XdmVii9i5sY4FChU8pB
2026-09-02 14:22:25 -04:00
parent 2969805e4e
commit c1e34c307e
7 changed files with 712 additions and 2 deletions
@@ -0,0 +1,69 @@
+-- ZB.MOM.WW.Auth.ApiKeys.SqlServer — shared API-key schema, version 1.
+--
+-- For DBAs whose application login lacks DDL rights. The host normally provisions this itself at
+-- startup (SqlServerApiKeyStoreMigrator, which runs the identical statements and is safe to run
+-- concurrently from every node); where the app login may only read and write rows, run this script
+-- once against the target database instead. The migrator then finds the version row already at the
+-- version it supports and does nothing further beyond re-stamping applied_utc.
+--
+-- The schema name is hard-coded to zbauth here — the default of SqlServerApiKeyOptions.Schema. If a
+-- deployment overrides that option, substitute the name in every bracketed identifier below.
+--
+-- Kept byte-for-byte consistent with SqlServerAuthSchema.CreateSchemaDdl apart from that
+-- substitution and the literal version row at the end; change both together.
+
+IF NOT EXISTS (SELECT 1 FROM sys.schemas WHERE name = N'zbauth')
+    EXEC(N'CREATE SCHEMA [zbauth]');
+
+IF OBJECT_ID(N'[zbauth].[schema_version]', N'U') IS NULL
+    CREATE TABLE [zbauth].[schema_version] (
+        id          INT               NOT NULL CONSTRAINT PK_zbauth_schema_version PRIMARY KEY CHECK (id = 1),
+        version     INT               NOT NULL,
+        applied_utc DATETIMEOFFSET(7) NOT NULL
+    );
+
+IF OBJECT_ID(N'[zbauth].[api_keys]', N'U') IS NULL
+    CREATE TABLE [zbauth].[api_keys] (
+        key_id        NVARCHAR(64)      NOT NULL CONSTRAINT PK_zbauth_api_keys PRIMARY KEY,
+        key_prefix    NVARCHAR(16)      NOT NULL,
+        secret_hash   VARBINARY(64)     NOT NULL,
+        display_name  NVARCHAR(256)     NOT NULL,
+        scopes        NVARCHAR(MAX)     NOT NULL,
+        constraints   NVARCHAR(MAX)     NULL,
+        created_utc   DATETIMEOFFSET(7) NOT NULL,
+        last_used_utc DATETIMEOFFSET(7) NULL,
+        revoked_utc   DATETIMEOFFSET(7) NULL,
+        expires_utc   DATETIMEOFFSET(7) NULL
+    );
+
+IF OBJECT_ID(N'[zbauth].[api_key_audit]', N'U') IS NULL
+    CREATE TABLE [zbauth].[api_key_audit] (
+        audit_id       BIGINT IDENTITY(1,1) NOT NULL CONSTRAINT PK_zbauth_api_key_audit PRIMARY KEY,
+        key_id         NVARCHAR(64)      NULL,
+        event_type     NVARCHAR(64)      NOT NULL,
+        remote_address NVARCHAR(64)      NULL,
+        created_utc    DATETIMEOFFSET(7) NOT NULL,
+        details        NVARCHAR(MAX)     NULL
+    );
+
+IF NOT EXISTS (
+    SELECT 1 FROM sys.indexes
+    WHERE name = N'ix_api_keys_revoked_utc'
+      AND object_id = OBJECT_ID(N'[zbauth].[api_keys]'))
+    CREATE INDEX ix_api_keys_revoked_utc
+        ON [zbauth].[api_keys] (revoked_utc);
+
+IF NOT EXISTS (
+    SELECT 1 FROM sys.indexes
+    WHERE name = N'ix_api_key_audit_key_id_created_utc'
+      AND object_id = OBJECT_ID(N'[zbauth].[api_key_audit]'))
+    CREATE INDEX ix_api_key_audit_key_id_created_utc
+        ON [zbauth].[api_key_audit] (key_id, created_utc);
+
+MERGE [zbauth].[schema_version] AS target
+USING (SELECT 1 AS id, 1 AS version, SYSDATETIMEOFFSET() AS applied_utc) AS source
+    ON target.id = source.id
+WHEN MATCHED THEN
+    UPDATE SET version = source.version, applied_utc = source.applied_utc
+WHEN NOT MATCHED THEN
+    INSERT (id, version, applied_utc) VALUES (1, source.version, source.applied_utc);