Harden admin deployment and local acceptance

Enforce mTLS and least-privilege runtime boundaries while adding repeatable MySQL 8.4 and Docker smoke checks that require no production secrets.
2026-08-17 15:20:46 +08:00
parent 1a9c518f96
commit 405a2cfc0f
17 changed files with 1480 additions and 37 deletions
@@ -0,0 +1,28 @@
+# Local Docker smoke verification
+
+Run from any directory:
+
+```bash
+/Users/rocky/Documents/OSGAccountServer/deploy/smoke-local.sh
+```
+
+Requirements: Docker with Compose v2, `curl`, `openssl`, and Python 3.
+
+The runner builds the current checkout, creates an isolated MySQL 8.4 project,
+generates one-time keys and administrator credentials, and uses an internal
+Docker network. Apple, DeepSeek, and Volcengine endpoints point to the
+container's closed loopback port, so no provider request can leave the project.
+
+The checks cover:
+
+- successful Flyway V1-V8 history and `/health/ready`;
+- hidden admin routes without the trusted edge header;
+- TOTP login, cookies, CSRF, role denial, core reads, grants, and logout;
+- a 101-row ledger fixture that requires a second cursor page;
+- an exact per-table runtime grant matrix;
+- denied `UPDATE` and `DELETE` on ledger, audit, and grant history.
+
+Containers, the named volume, the local smoke image, cookie jars, generated
+keys, and administrator credentials are removed on exit. On failure, only
+recent container status and logs remain in the printed temporary diagnostics
+path.
@@ -0,0 +1,47 @@
+-- A disposable account with more than one admin-ledger page.
+INSERT INTO accounts (
+    id,
+    apple_sub,
+    created_at,
+    updated_at,
+    identity_fingerprint,
+    anti_abuse_restricted
+) VALUES (
+    '10000000-0000-0000-0000-000000000001',
+    'smoke-only-apple-subject',
+    UTC_TIMESTAMP(6),
+    UTC_TIMESTAMP(6),
+    REPEAT('1', 64),
+    FALSE
+);
+
+INSERT INTO credit_accounts (user_id, balance, updated_at)
+VALUES ('10000000-0000-0000-0000-000000000001', 101, UTC_TIMESTAMP(6));
+
+INSERT INTO credit_ledger (
+    id,
+    user_id,
+    entry_type,
+    amount_delta,
+    balance_after,
+    idempotency_key,
+    reference_id,
+    created_at
+)
+WITH RECURSIVE sequence_number AS (
+    SELECT 1 AS value
+    UNION ALL
+    SELECT value + 1
+    FROM sequence_number
+    WHERE value < 101
+)
+SELECT
+    CONCAT('20000000-0000-0000-0000-', LPAD(value, 12, '0')),
+    '10000000-0000-0000-0000-000000000001',
+    'SIGNUP_TRIAL',
+    1,
+    value,
+    CONCAT('smoke-ledger-', LPAD(value, 4, '0')),
+    NULL,
+    TIMESTAMPADD(MICROSECOND, value, '2026-01-01 00:00:00.000000')
+FROM sequence_number;
@@ -0,0 +1,54 @@
+-- Smoke-only grants. The user and schema are disposable and never point at production.
+GRANT SELECT ON osg_account_smoke.accounts TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.apple_credentials TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.sessions TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.apple_event_receipts TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.credit_accounts TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.credit_rate_versions TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.credit_reservations TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.referral_campaigns TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.referral_campaign_budgets TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.referral_codes TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.referral_bindings TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.credit_usage_records TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.credit_ledger TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.provider_requests TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.usage_records TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.gateway_grants TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.gateway_grant_scopes TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.gateway_refresh_tokens TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.devicecheck_trial_claims TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.app_attest_challenges TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.app_attest_keys TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.account_identity_tombstones TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.apple_revocation_outbox TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.admin_operators TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.admin_sessions TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.admin_audit_log TO 'osg_smoke_runtime'@'%';
+GRANT SELECT ON osg_account_smoke.admin_credit_grants TO 'osg_smoke_runtime'@'%';
+
+GRANT INSERT, UPDATE, DELETE ON osg_account_smoke.accounts TO 'osg_smoke_runtime'@'%';
+GRANT INSERT, UPDATE ON osg_account_smoke.apple_credentials TO 'osg_smoke_runtime'@'%';
+GRANT INSERT, UPDATE ON osg_account_smoke.sessions TO 'osg_smoke_runtime'@'%';
+GRANT INSERT ON osg_account_smoke.apple_event_receipts TO 'osg_smoke_runtime'@'%';
+GRANT INSERT, UPDATE ON osg_account_smoke.credit_accounts TO 'osg_smoke_runtime'@'%';
+GRANT INSERT, UPDATE ON osg_account_smoke.credit_reservations TO 'osg_smoke_runtime'@'%';
+GRANT UPDATE ON osg_account_smoke.referral_campaign_budgets TO 'osg_smoke_runtime'@'%';
+GRANT INSERT ON osg_account_smoke.referral_codes TO 'osg_smoke_runtime'@'%';
+GRANT INSERT, UPDATE ON osg_account_smoke.referral_bindings TO 'osg_smoke_runtime'@'%';
+GRANT INSERT ON osg_account_smoke.credit_usage_records TO 'osg_smoke_runtime'@'%';
+GRANT INSERT ON osg_account_smoke.credit_ledger TO 'osg_smoke_runtime'@'%';
+GRANT INSERT, UPDATE ON osg_account_smoke.provider_requests TO 'osg_smoke_runtime'@'%';
+GRANT INSERT ON osg_account_smoke.usage_records TO 'osg_smoke_runtime'@'%';
+GRANT INSERT, UPDATE ON osg_account_smoke.gateway_grants TO 'osg_smoke_runtime'@'%';
+GRANT INSERT ON osg_account_smoke.gateway_grant_scopes TO 'osg_smoke_runtime'@'%';
+GRANT INSERT, UPDATE ON osg_account_smoke.gateway_refresh_tokens TO 'osg_smoke_runtime'@'%';
+GRANT INSERT, UPDATE ON osg_account_smoke.devicecheck_trial_claims TO 'osg_smoke_runtime'@'%';
+GRANT INSERT, UPDATE ON osg_account_smoke.app_attest_challenges TO 'osg_smoke_runtime'@'%';
+GRANT INSERT, UPDATE ON osg_account_smoke.app_attest_keys TO 'osg_smoke_runtime'@'%';
+GRANT INSERT, UPDATE ON osg_account_smoke.account_identity_tombstones TO 'osg_smoke_runtime'@'%';
+GRANT INSERT, UPDATE ON osg_account_smoke.apple_revocation_outbox TO 'osg_smoke_runtime'@'%';
+GRANT INSERT, UPDATE ON osg_account_smoke.admin_operators TO 'osg_smoke_runtime'@'%';
+GRANT INSERT, UPDATE, DELETE ON osg_account_smoke.admin_sessions TO 'osg_smoke_runtime'@'%';
+GRANT INSERT ON osg_account_smoke.admin_audit_log TO 'osg_smoke_runtime'@'%';
+GRANT INSERT ON osg_account_smoke.admin_credit_grants TO 'osg_smoke_runtime'@'%';