Fix/identity sql local db - #252
Merged
Merged
Conversation
…rkspace com isolamento cross-workspace
- Modelo de dominio: FiscalUser, ExternalIdentity, FiscalWorkspace, WorkspaceMembership
- SqlIdentityWorkspaceStore: persistencia idempotente (UNIQUE constraint + retry em corrida)
- IdentityWorkspaceService: trava em processo + politica fail-closed
- TrustedIdentityMiddleware estendido (nao substituido) para os headers
x-layoutparser-identity-{provider,subject,tenant}, mesma guarda de loopback
- WorkspacesController: GET /api/workspaces/me e GET /api/workspaces/{workspaceId}
(404 uniforme para nao-existe/nao-e-seu, 401 explicito no /me sem identidade)
- Testes de isolamento cross-workspace, idempotencia sob concorrencia e
subject-nunca-logado (issues #225/#228)
dotnet build e dotnet test (437/437) verdes.
…ocal dedicado O SqlIdentityWorkspaceStore reusava o banco ConnectUS_Macgyver do Sysmiddle, causando erro de FK em producao: dbo.tbUser ja existia como tabela legada do Sysmiddle com schema incompativel, entao o EnsureSchemaAsync pulava a criacao e a FK de tbExternalIdentity falhava. Move para uma nova secao de config "IdentityDatabase:*" (SQL Server local a maquina da API, credencial separada da do Sysmiddle) e renomeia as tabelas com prefixo tbLp* como defesa extra contra colisao de nome.
…o de dev Adiciona IdentityDatabase__Server/Database/UserId/Password ao Environment do servico Windows nativo em ci-dev.yml, no mesmo mecanismo ja usado para Database__Password (secrets DB_PASSWORD_DEV). Server/Database vem de variables (IDENTITY_DB_SERVER/IDENTITY_DB_NAME, nao sensiveis); UserId/ Password vem de secrets (IDENTITY_DB_USERID/IDENTITY_DB_PASSWORD), ja criados no repositorio. Substitui o uso indevido do banco Sysmiddle ConnectUS_Macgyver por SqlIdentityWorkspaceStore.cs (Error 1770 de FK). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DcGnNut7qW3Zz5qEZxXPp6
…ao (upsert) Estende o step de ambiente do deploy.yml com IdentityDatabase__Server/Database/UserId/Password, mesmos secrets/variables do ci-dev.yml, seguindo a semantica de upsert ja existente. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DcGnNut7qW3Zz5qEZxXPp6
…a sanitizacao de log + banco dedicado)
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.