Harden admin deployment and local acceptance

Enforce mTLS and least-privilege runtime boundaries while adding repeatable MySQL 8.4 and Docker smoke checks that require no production secrets.
2026-08-17 15:20:46 +08:00
parent 1a9c518f96
commit 405a2cfc0f
17 changed files with 1480 additions and 37 deletions
@@ -0,0 +1,47 @@
+-- A disposable account with more than one admin-ledger page.
+INSERT INTO accounts (
+    id,
+    apple_sub,
+    created_at,
+    updated_at,
+    identity_fingerprint,
+    anti_abuse_restricted
+) VALUES (
+    '10000000-0000-0000-0000-000000000001',
+    'smoke-only-apple-subject',
+    UTC_TIMESTAMP(6),
+    UTC_TIMESTAMP(6),
+    REPEAT('1', 64),
+    FALSE
+);
+
+INSERT INTO credit_accounts (user_id, balance, updated_at)
+VALUES ('10000000-0000-0000-0000-000000000001', 101, UTC_TIMESTAMP(6));
+
+INSERT INTO credit_ledger (
+    id,
+    user_id,
+    entry_type,
+    amount_delta,
+    balance_after,
+    idempotency_key,
+    reference_id,
+    created_at
+)
+WITH RECURSIVE sequence_number AS (
+    SELECT 1 AS value
+    UNION ALL
+    SELECT value + 1
+    FROM sequence_number
+    WHERE value < 101
+)
+SELECT
+    CONCAT('20000000-0000-0000-0000-', LPAD(value, 12, '0')),
+    '10000000-0000-0000-0000-000000000001',
+    'SIGNUP_TRIAL',
+    1,
+    value,
+    CONCAT('smoke-ledger-', LPAD(value, 4, '0')),
+    NULL,
+    TIMESTAMPADD(MICROSECOND, value, '2026-01-01 00:00:00.000000')
+FROM sequence_number;