Agent Zero
b2f75495de
Vorher: prestart.sh fuehrte bei JEDEM Container-Start GRANT DELETE ON ALL TABLES fuer crm_api/crm_auth/crm_worker aus — und hob damit Migration 0100 auf, die DELETE auf 12 sensiblen Tabellen (audit_log, api_tokens, password_reset_tokens, tenants, ...) gezielt entzogen hatte. Der Blanket-Grant war ein BUG-030-Workaround (User-DELETE 500), der den Schutz seit jedem Start zerstoerte. Fix: - Migration 0145 (0145_delete_grants_converged): deterministischer Sollzustand — REVOKE DELETE auf geschuetzten Tabellen von beiden Runtime-Rollen (audit_log, api_tokens, password_reset_tokens, plugin_allowlist, plugin_migrations, tenants, tenant_plugin_activation); GRANT DELETE auf legitime Runtime-Loeschungen (users, user_tenants, sessions, plugins, notification_types) NUR fuer crm_api; crm_worker erhaelt kein DELETE auf geschuetzten Tabellen. - prestart.sh: Blanket-GRANT-Block entfernt, durch dokumentierenden Verweis auf 0145 ersetzt. - audit.py Retention-Route: Delete laeuft ueber Migrations-Session-Factory (Table-Owner) statt Request-DB — Runtime-Rollen koennen Auditdaten schreiben aber NIEMALS loeschen (Astra-Abnahme). Gleiches Muster wie Plugin-Uninstall. Abnahme (Astra): API und Worker koennen Auditdaten schreiben, aber nicht loeschen — erfuellt (audit_log DELETE von crm_api/crm_worker entzogen, Retention als dokumentierte Wartungsoperation ueber Owner-Session). Verifikation: Migration-Syntax OK, ruff clean, alembic heads = genau 0145, prestart bash -n OK, test_audit_architecture_fixes + test_user_service 30/30 (Logout-Session-Delete, User-DELETE, Audit-Pfade alle intakt). Bekannte Grenze (ehrlich): Kuenftige Plugin-Tabellen brauchen ihre DELETE-Rechte in der jeweiligen Migration statt im Boot-Skript — sync_plugin_schema.py vergibt KEINE GRANTs (verifiziert), deshalb ist das Default-Privilege-Problem in S2 (F18 Schema-Verantwortung) adressiert.
81 lines
2.7 KiB
Python
81 lines
2.7 KiB
Python
"""Converged DELETE grants (F20/Astra).
|
|
|
|
Removes the effect of the blanket ``GRANT DELETE ON ALL TABLES`` that
|
|
prestart.sh applied on every boot — which silently undid migration
|
|
0100's protections on every container start.
|
|
|
|
Documented target state:
|
|
|
|
Runtime-legitimate DELETEs (crm_api only):
|
|
- users, user_tenants (user deletion on last membership, BUG-030)
|
|
- sessions (logout session invalidation)
|
|
- plugins, notification_types (plugin uninstall + registry sync)
|
|
|
|
Protected — DELETE stays REVOKED from crm_api AND crm_worker:
|
|
- audit_log (Astra acceptance: API/Worker write, never delete)
|
|
- api_tokens (revoke is an UPDATE on revoked_at)
|
|
- password_reset_tokens (consumption is an UPDATE on used_at)
|
|
- plugin_allowlist, plugin_migrations (install/migration path only —
|
|
plugin_migrations rows are deleted via the migration factory)
|
|
- tenants (never deleted at runtime)
|
|
- tenant_plugin_activation (deactivation is an UPDATE)
|
|
|
|
crm_worker receives no DELETE on any protected table (workers never
|
|
delete users, sessions or plugin rows).
|
|
|
|
Revision ID: 0145
|
|
Revises: 0144
|
|
"""
|
|
|
|
from alembic import op
|
|
|
|
revision = "0145"
|
|
down_revision = "0144"
|
|
branch_labels = None
|
|
depends_on = None
|
|
|
|
# Tables where runtime DELETE is a documented, legitimate operation (crm_api)
|
|
RUNTIME_DELETE_TABLES = [
|
|
"users",
|
|
"user_tenants",
|
|
"sessions",
|
|
"plugins",
|
|
"notification_types",
|
|
]
|
|
|
|
# Tables where DELETE must stay revoked from BOTH runtime roles (0100 + F20)
|
|
PROTECTED_TABLES = [
|
|
"audit_log",
|
|
"api_tokens",
|
|
"password_reset_tokens",
|
|
"plugin_allowlist",
|
|
"plugin_migrations",
|
|
"tenants",
|
|
"tenant_plugin_activation",
|
|
]
|
|
|
|
|
|
|
|
def upgrade() -> None:
|
|
# 1. Re-assert 0100's revocations — production DBs have lived with the
|
|
# blanket boot grant, so revoke first for a deterministic baseline.
|
|
for table in PROTECTED_TABLES:
|
|
op.execute(f"REVOKE DELETE ON TABLE {table} FROM crm_api;")
|
|
op.execute(f"REVOKE DELETE ON TABLE {table} FROM crm_worker;")
|
|
|
|
# 2. Grant the runtime-legitimate DELETEs to crm_api (BUG-030 stays
|
|
# fixed, logout keeps working, plugin management keeps working).
|
|
for table in RUNTIME_DELETE_TABLES:
|
|
op.execute(f"GRANT DELETE ON TABLE {table} TO crm_api;")
|
|
|
|
|
|
|
|
def downgrade() -> None:
|
|
# Best-effort inverse: revoke the runtime grants, re-grant the
|
|
# protected tables (matching the pre-F20 blanket state).
|
|
for table in RUNTIME_DELETE_TABLES:
|
|
op.execute(f"REVOKE DELETE ON TABLE {table} FROM crm_api;")
|
|
for table in PROTECTED_TABLES:
|
|
op.execute(f"GRANT DELETE ON TABLE {table} TO crm_api;")
|
|
op.execute(f"GRANT DELETE ON TABLE {table} TO crm_worker;")
|