Makes a redeploy safe for the key ring and the schema
Nothing here is visible in normal operation. Its whole purpose is that swapping the release directory on deploy cannot silently destroy state. Data Protection secures the API keys that authenticate master/slave communication. Two separate defaults would each have destroyed them: keys are held on the filesystem, which a release swap discards, and the application discriminator is derived from the content root path, which changes with every release directory — so even keys stored in a database would have stopped being derivable. Keys now live in ApplicationDbContext and the discriminator is a fixed constant. Losing them produces no error. It produces stored keys that no longer decrypt, which presents as an apparent network fault between a Master and its slaves and is easily misdiagnosed. That is also why the tests assert the resulting configuration rather than the registration: the XmlRepository must be the EF one and the discriminator must be the constant, plus a round-trip proving a value encrypted before a deploy is readable after one. A test that only checked "Data Protection is registered" would have passed in the broken case too. Both modules previously called AddDataProtection() themselves. Module registration runs after the host's, so those calls re-registered the configuration chain and would have overridden the persistent store while IDataProtector still resolved. They are removed, with a comment at each site — the deletion otherwise looks like a regression. Each module's own test project now guards against it being reintroduced. ApplicationDbContext also migrates itself at startup. Deploy targets offer no CLI, so migrations cannot be a manual step on the server. Failures are classified rather than treated alike: a connection failure means the database is not up yet, normal when the app and the database start together after a reboot, and is retried with backoff; a migration failure means something is broken and fails at once. Either way the process does not start, which is what makes the liveness health check trustworthy — an application that cannot reach its schema never answers /health, so monitoring goes red instead of reporting a healthy instance that cannot serve a request. The cost of migrating without a human gate is that migrations must stay forward-compatible and non-destructive, since rollback is "redeploy the previous release". The new migration is purely additive. Also wires this and the preceding hosting commit into both hosts, as they touch the same lines of Program.cs. Two constraints are enforced by documentation rather than code, and belong in the deployment instructions: the key table must never be pruned, and only one instance may migrate a given database at a time. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHoJpxYXzHACSQguHrC5fw
This commit is contained in:
Claude Opus 5
+87
@@ -0,0 +1,87 @@
|
||||
# Code Generation Summary — U2 Data Durability
|
||||
|
||||
**Date**: 2026-07-27
|
||||
**Requirements**: FR-11, FR-12
|
||||
|
||||
---
|
||||
|
||||
## Files Created
|
||||
|
||||
| Path | Purpose |
|
||||
|---|---|
|
||||
| `src/SlpModularCms.Core/Hosting/DataProtectionExtensions.cs` | `AddCmsDataProtection()` — database key ring, fixed discriminator |
|
||||
| `src/SlpModularCms.Core/Hosting/DatabaseMigrationExtensions.cs` | `MigrateCoreDatabase()` — startup migration with failure classification |
|
||||
| `src/SlpModularCms.Core/Migrations/20260727203036_AddDataProtectionKeys.cs` | Keys table migration |
|
||||
| `src/SlpModularCms.Core.Tests/Hosting/DataProtectionExtensionsTests.cs` | 4 tests |
|
||||
| `src/SlpModularCms.Core.Tests/Hosting/DatabaseMigrationExtensionsTests.cs` | 7 tests |
|
||||
| `src/SlpModularCms.Modules.Availability.Tests/AvailabilityModuleDataProtectionTests.cs` | 1 test |
|
||||
| `src/SlpModularCms.Modules.Master.Tests/MasterModuleDataProtectionTests.cs` | 1 test |
|
||||
|
||||
## Files Modified
|
||||
|
||||
| Path | Change |
|
||||
|---|---|
|
||||
| `src/SlpModularCms.Core/SlpModularCms.Core.csproj` | `Microsoft.AspNetCore.DataProtection.EntityFrameworkCore` 10.0.9 |
|
||||
| `src/SlpModularCms.Core/Data/ApplicationDbContext.cs` | Implements `IDataProtectionKeyContext`; `DataProtectionKeys` set |
|
||||
| `src/SlpModularCms.Modules.Availability/AvailabilityModule.cs` | `AddDataProtection()` removed |
|
||||
| `src/SlpModularCms.Modules.Master/MasterModule.cs` | `AddDataProtection()` removed |
|
||||
| `src/SlpModularCms.Api/Program.cs` | `AddCmsDataProtection()` before module registration; `MigrateCoreDatabase()` after build |
|
||||
| `src/SlpModularCms.Api.Slave/Program.cs` | Same |
|
||||
|
||||
No duplicate or parallel files were created.
|
||||
|
||||
---
|
||||
|
||||
## Implementation Decisions
|
||||
|
||||
### The removals are the point of this unit, so they are commented in place
|
||||
Deleting `services.AddDataProtection()` from two modules looks like a regression to anyone who does not know the ordering issue. Both call sites therefore carry a comment explaining that the host owns Data Protection and that a bare call here would silently discard the persistent key store.
|
||||
|
||||
### The tests assert configuration, not registration
|
||||
A test asserting "Data Protection is registered" passes in both the broken and fixed cases, because `IDataProtector` resolves either way. Every test here inspects the **resulting** configuration instead:
|
||||
|
||||
- `KeyManagementOptions.XmlRepository` is `EntityFrameworkCoreXmlRepository<ApplicationDbContext>` — not the filesystem default
|
||||
- `DataProtectionOptions.ApplicationDiscriminator` is the fixed constant — not the path-derived default
|
||||
- A protected value survives a simulated restart from a different release directory, which is the property that actually matters
|
||||
- The discriminator contains no path separator, guarding against a future "improvement" that makes it computed or configurable
|
||||
|
||||
The module-level tests live in each module's own test project rather than in `Core.Tests`, because `Core.Tests` does not reference the modules. Each registers the host's Data Protection first and the module second — the real ordering — and asserts the EF repository survives.
|
||||
|
||||
### `SqlException` is produced genuinely, not faked
|
||||
`SqlException` has no public constructor. Rather than substituting a stand-in type, the test provokes a real one by opening a connection to an unreachable host with a one-second timeout. The classifier is therefore exercised against the exact type it will meet in production.
|
||||
|
||||
### Wrong credentials are classified as a connection failure
|
||||
Distinguishing bad credentials from an unreachable server would add branching for no benefit: retries are exhausted and the process does not start either way. The simpler classification is the honest one.
|
||||
|
||||
### Migration verified as additive
|
||||
The generated migration only creates a table — no dropped or narrowed columns. Rollback by redeploying an earlier release therefore stays safe, which BR-U2-16 requires and which the whole rollback strategy depends on.
|
||||
|
||||
---
|
||||
|
||||
## Operational Constraints Enforced by Documentation, Not Code
|
||||
|
||||
Both were decided deliberately (U2 FD Q4 = C, Q5 = C). They must appear in the Operations deployment instructions:
|
||||
|
||||
| Constraint | Why it is not enforced in code |
|
||||
|---|---|
|
||||
| **The `DataProtectionKeys` table must never be pruned.** Deleting a key makes every value encrypted with it permanently unreadable, including stored slave API keys. | Nothing in the application deletes these rows; the risk comes from a human treating the table as housekeeping. It is the single most destructive maintenance action available against this system, and it looks harmless. |
|
||||
| **Only one instance may migrate a given database at a time.** | One instance per database holds by design today — the Master and each slave have their own. A distributed migration lock would add failure modes without removing any. **If the deployment model ever changes to multiple instances sharing a database, automatic startup migration must be revisited before that change is made.** |
|
||||
|
||||
Also recorded for Operations: **DEV-05** — keys are stored unencrypted at rest, with TLS on the database connection and a non-public database as the compensating controls (BR-U2-08). These are not optional extras; they are what makes the deviation acceptable.
|
||||
|
||||
---
|
||||
|
||||
## Verification
|
||||
|
||||
| Check | Result |
|
||||
|---|---|
|
||||
| `dotnet build SlpModularCms.sln -c Release` | ✅ 0 errors |
|
||||
| `SlpModularCms.Core.Tests` | ✅ 83 passed |
|
||||
| `SlpModularCms.Modules.Availability.Tests` | ✅ 82 passed |
|
||||
| `SlpModularCms.Modules.Identity.Tests` | ✅ 37 passed |
|
||||
| `SlpModularCms.Modules.Master.Tests` | ✅ 51 passed |
|
||||
| Migration is purely additive | ✅ Inspected — creates one table, drops nothing |
|
||||
|
||||
No failures occurred during generation.
|
||||
|
||||
**Not verifiable at this stage**: the composed startup path (`MigrateCoreDatabase` against a real database, and both hosts actually starting) requires SQL Server. Carried to the phase-level Build and Test stage.
|
||||
+194
@@ -0,0 +1,194 @@
|
||||
# Business Logic Model — U2 Data Durability
|
||||
|
||||
**Unit**: U2 Data Durability
|
||||
**Requirements**: FR-11, FR-12
|
||||
|
||||
---
|
||||
|
||||
## 1. Scope of the Logic
|
||||
|
||||
U2 delivers nothing a user can see. Its entire value is negative: after this unit, a redeploy **cannot** silently destroy schema state or the trust relationship between a Master and its slaves.
|
||||
|
||||
Two mechanisms:
|
||||
1. **Key ring durability** — Data Protection keys move from the filesystem (discarded by every atomic release switch) into the database, with an application discriminator that does not change when the release directory does
|
||||
2. **Schema convergence** — `ApplicationDbContext` migrates itself at startup, so a deployment needs no CLI access to the host
|
||||
|
||||
Both are startup-time concerns. Neither participates in request handling.
|
||||
|
||||
---
|
||||
|
||||
## 2. Startup Sequence
|
||||
|
||||
```mermaid
|
||||
graph TD
|
||||
boot["Host builder starts"]
|
||||
log["Configure logging and Sentry"]
|
||||
disc["Discover modules"]
|
||||
core["AddCoreInfrastructure"]
|
||||
dp["AddCmsDataProtection<br/>persistent key store plus<br/>fixed application discriminator"]
|
||||
mods["Module RegisterServices<br/>AddDataProtection removed from both"]
|
||||
build["Build application"]
|
||||
mig["Migrate ApplicationDbContext"]
|
||||
classify{"Failure type ?"}
|
||||
retry["Retry with backoff"]
|
||||
fail["Propagate: process does not start"]
|
||||
usemods["UseModules<br/>module contexts migrate"]
|
||||
serve["Accept traffic"]
|
||||
|
||||
boot --> log
|
||||
log --> disc
|
||||
disc --> core
|
||||
core --> dp
|
||||
dp --> mods
|
||||
mods --> build
|
||||
build --> mig
|
||||
mig -->|success| usemods
|
||||
mig -->|failure| classify
|
||||
classify -->|"connection failure"| retry
|
||||
classify -->|"migration failure"| fail
|
||||
retry -->|"attempts remain"| mig
|
||||
retry -->|"attempts exhausted"| fail
|
||||
usemods --> serve
|
||||
|
||||
classDef entry fill:#f6e05e,stroke:#c05621,stroke-width:1px,color:#000;
|
||||
classDef step fill:#9ae6b4,stroke:#2f855a,stroke-width:1px,color:#000;
|
||||
classDef critical fill:#90cdf4,stroke:#2b6cb0,stroke-width:1px,color:#000;
|
||||
classDef bad fill:#fbb6ce,stroke:#b83280,stroke-width:1px,color:#000;
|
||||
class boot entry;
|
||||
class log,disc,core,mods,build,usemods,serve step;
|
||||
class dp,mig,classify,retry critical;
|
||||
class fail bad;
|
||||
```
|
||||
|
||||
Text alternative: Data Protection is configured with a persistent store before module registration, the Core context migrates before the module contexts, and a migration failure is classified — connection failures are retried with backoff while genuine migration failures stop the process immediately.
|
||||
|
||||
---
|
||||
|
||||
## 3. The Registration-Order Conflict
|
||||
|
||||
This is the unit's most important piece of logic, and it is a *removal* rather than an addition.
|
||||
|
||||
`AvailabilityModule.RegisterServices` and `MasterModule.RegisterServices` each call `services.AddDataProtection()` today. Module registration runs **after** the host's registration. In ASP.NET Core, a later `AddDataProtection()` re-registers the configuration chain, so the modules' bare calls would discard the persistent key store configured by the host.
|
||||
|
||||
```mermaid
|
||||
graph TD
|
||||
subgraph broken["Without the fix"]
|
||||
h1["Host: AddCmsDataProtection<br/>persistent store configured"]
|
||||
m1["AvailabilityModule: AddDataProtection"]
|
||||
m2["MasterModule: AddDataProtection"]
|
||||
r1["Result: filesystem key ring<br/>FR-12 silently ineffective"]
|
||||
h1 --> m1
|
||||
m1 --> m2
|
||||
m2 --> r1
|
||||
end
|
||||
|
||||
subgraph fixed["With the fix"]
|
||||
h2["Host: AddCmsDataProtection<br/>persistent store configured"]
|
||||
m3["Modules: no Data Protection call<br/>they consume IDataProtector only"]
|
||||
r2["Result: database key ring<br/>survives release switches"]
|
||||
h2 --> m3
|
||||
m3 --> r2
|
||||
end
|
||||
|
||||
classDef good fill:#9ae6b4,stroke:#2f855a,stroke-width:1px,color:#000;
|
||||
classDef bad fill:#fbb6ce,stroke:#b83280,stroke-width:1px,color:#000;
|
||||
classDef neutral fill:#90cdf4,stroke:#2b6cb0,stroke-width:1px,color:#000;
|
||||
class h1,h2,m3 neutral;
|
||||
class m1,m2,r1 bad;
|
||||
class r2 good;
|
||||
```
|
||||
|
||||
Text alternative: leaving the modules' own Data Protection calls in place would override the host's persistent key store and leave the key ring on the filesystem, whereas removing them lets the host's single configuration stand.
|
||||
|
||||
**Why this is dangerous rather than merely wrong**: registration tests pass either way — `IDataProtector` resolves in both cases. The defect appears only after the first atomic release switch, as slave API keys that no longer decrypt, presenting as a network fault between Master and slave. The verification for this unit must therefore assert the **resulting configuration**, not merely that Data Protection is registered.
|
||||
|
||||
---
|
||||
|
||||
## 4. Application Discriminator Stability
|
||||
|
||||
The application discriminator determines whether two processes derive the same keys. By default it is derived from the content root path — which changes on every atomic release switch. Persisting keys in the database while letting the discriminator move would produce keys that are stored but unusable: a second, quieter version of the same failure.
|
||||
|
||||
Per Q1 = A the discriminator is a **fixed constant in code**.
|
||||
|
||||
```mermaid
|
||||
graph TD
|
||||
r1["Release directory 1<br/>content root /srv/cms/releases/001"]
|
||||
r2["Release directory 2<br/>content root /srv/cms/releases/002"]
|
||||
disc["Fixed discriminator constant"]
|
||||
keys[("Key ring in database")]
|
||||
same["Same keys derived<br/>stored values stay readable"]
|
||||
|
||||
r1 --> disc
|
||||
r2 --> disc
|
||||
disc --> keys
|
||||
keys --> same
|
||||
|
||||
classDef release fill:#90cdf4,stroke:#2b6cb0,stroke-width:1px,color:#000;
|
||||
classDef fixed fill:#fbd38d,stroke:#c05621,stroke-width:1px,color:#000;
|
||||
classDef store fill:#d6bcfa,stroke:#6b46c1,stroke-width:1px,color:#000;
|
||||
classDef good fill:#9ae6b4,stroke:#2f855a,stroke-width:1px,color:#000;
|
||||
class r1,r2 release;
|
||||
class disc fixed;
|
||||
class keys store;
|
||||
class same good;
|
||||
```
|
||||
|
||||
Text alternative: two different release directories both use the same fixed discriminator, so the keys stored in the database remain derivable and previously encrypted values stay readable across deploys.
|
||||
|
||||
**Why a constant rather than configuration** (Q1 = A): it cannot be set wrong, forgotten during a host migration, or accidentally differ between two instances that share a database. A configurable value would add a way to reintroduce the exact failure this unit exists to prevent.
|
||||
|
||||
---
|
||||
|
||||
## 5. Migration Failure Classification
|
||||
|
||||
Per Q3 = C, failures are classified rather than treated uniformly:
|
||||
|
||||
| Failure kind | Meaning | Response |
|
||||
|---|---|---|
|
||||
| **Connection failure** | The database is not reachable yet — typically the app and SQL Server starting together after a host reboot | Retry with increasing delay, then fail |
|
||||
| **Migration failure** | A migration is invalid, conflicts, or cannot be applied | Fail immediately, no retry |
|
||||
|
||||
Retrying a genuine migration failure would only delay the inevitable while making the log harder to read. Failing instantly on a transient connection error would make a host reboot look like a broken deployment.
|
||||
|
||||
**Interaction with U1's health check**: after retries are exhausted the exception propagates and the process does not start. `/health` then does not answer, and UptimeRobot goes red. That chain is the entire reason a liveness-only check is sufficient — it is meaningful precisely because startup is strict.
|
||||
|
||||
---
|
||||
|
||||
## 6. Migration Ordering
|
||||
|
||||
```mermaid
|
||||
graph TD
|
||||
corectx["ApplicationDbContext<br/>Identity, refresh tokens,<br/>invitations, Data Protection keys"]
|
||||
availctx["AvailabilityDbContext<br/>master registration"]
|
||||
masterctx["MasterDbContext<br/>CMS instances"]
|
||||
protector["IDataProtector consumers<br/>encrypted API keys"]
|
||||
|
||||
corectx -->|"migrates first, at startup"| availctx
|
||||
corectx -->|"migrates first, at startup"| masterctx
|
||||
corectx -->|"keys table must exist before"| protector
|
||||
availctx -->|"uses"| protector
|
||||
masterctx -->|"uses"| protector
|
||||
|
||||
classDef core fill:#fbd38d,stroke:#c05621,stroke-width:1px,color:#000;
|
||||
classDef module fill:#9ae6b4,stroke:#2f855a,stroke-width:1px,color:#000;
|
||||
classDef consumer fill:#90cdf4,stroke:#2b6cb0,stroke-width:1px,color:#000;
|
||||
class corectx core;
|
||||
class availctx,masterctx module;
|
||||
class protector consumer;
|
||||
```
|
||||
|
||||
Text alternative: the Core context migrates first because it now owns the Data Protection keys table, which both module contexts depend on indirectly through their encrypted API key handling.
|
||||
|
||||
**Why Core must be first**: the keys table lives in `ApplicationDbContext` (Q7 of Application Design = A). Both modules encrypt and decrypt API keys. If a module migrated and immediately used an `IDataProtector` before the keys table existed, key generation would fail against a missing table.
|
||||
|
||||
**Scope boundary**: U2 adds automatic migration for `ApplicationDbContext` only. `AvailabilityDbContext` and `MasterDbContext` already migrate themselves in their `UseModule` implementations, and that existing behaviour is left untouched — changing it would alter module behaviour beyond this feature's scope.
|
||||
|
||||
---
|
||||
|
||||
## 7. Concurrent Migration
|
||||
|
||||
Per Q4 = C, no locking mechanism is built. The design assumption is **one instance per database**, which holds today: the Master and each slave have their own database.
|
||||
|
||||
This is documented in the deployment instructions as an operational constraint rather than enforced in code — building a distributed migration lock for a situation that cannot currently occur would add failure modes without removing any.
|
||||
|
||||
**Recorded as an assumption**: if the deployment model ever changes to multiple instances sharing one database, automatic startup migration must be revisited before that change is made.
|
||||
+130
@@ -0,0 +1,130 @@
|
||||
# Business Rules — U2 Data Durability
|
||||
|
||||
---
|
||||
|
||||
## Migration Decision Logic
|
||||
|
||||
```mermaid
|
||||
graph TD
|
||||
start["Startup: migrate ApplicationDbContext"]
|
||||
attempt["Attempt migration"]
|
||||
ok{"Succeeded ?"}
|
||||
done["Continue startup"]
|
||||
kind{"Failure kind ?"}
|
||||
attempts{"Retry attempts remaining ?"}
|
||||
wait["Wait with increasing delay"]
|
||||
logfail["Log the failure with context"]
|
||||
stop["Propagate: process does not start"]
|
||||
|
||||
start --> attempt
|
||||
attempt --> ok
|
||||
ok -->|yes| done
|
||||
ok -->|no| kind
|
||||
kind -->|"connection failure"| attempts
|
||||
kind -->|"migration failure"| logfail
|
||||
attempts -->|yes| wait
|
||||
attempts -->|no| logfail
|
||||
wait --> attempt
|
||||
logfail --> stop
|
||||
|
||||
classDef entry fill:#f6e05e,stroke:#c05621,stroke-width:1px,color:#000;
|
||||
classDef decision fill:#90cdf4,stroke:#2b6cb0,stroke-width:1px,color:#000;
|
||||
classDef good fill:#9ae6b4,stroke:#2f855a,stroke-width:1px,color:#000;
|
||||
classDef bad fill:#fbb6ce,stroke:#b83280,stroke-width:1px,color:#000;
|
||||
class start entry;
|
||||
class ok,kind,attempts decision;
|
||||
class attempt,wait,done good;
|
||||
class logfail,stop bad;
|
||||
```
|
||||
|
||||
Text alternative: migration is retried with increasing delay only when the failure is a connection problem; a genuine migration failure is logged and stops the process immediately, as does exhausting the retry attempts.
|
||||
|
||||
---
|
||||
|
||||
## Key Ring Durability Rules
|
||||
|
||||
| ID | Rule |
|
||||
|---|---|
|
||||
| **BR-U2-01** | Data Protection keys are persisted in the database, in the context that owns Identity — never on the filesystem. |
|
||||
| **BR-U2-02** | The application discriminator is a **fixed constant in code**. It is not derived from any path, and it is not configurable. |
|
||||
| **BR-U2-03** | Data Protection is configured **exactly once**, by the host, before module service registration. |
|
||||
| **BR-U2-04** | No module may call `AddDataProtection()`. Modules consume `IDataProtector` only. |
|
||||
| **BR-U2-05** | Key lifetime uses the framework default of 90 days, with automatic rotation. |
|
||||
| **BR-U2-06** | Old keys are **never** deleted. Removing a key makes every value encrypted with it permanently unreadable, including stored slave API keys. |
|
||||
| **BR-U2-07** | Keys are stored unencrypted at rest in the database. This is an accepted, documented deviation — see DEV-05. |
|
||||
| **BR-U2-08** | The database connection must enforce TLS, and the database must not be publicly reachable. These are the compensating controls for BR-U2-07. |
|
||||
|
||||
**Rationale for BR-U2-02**: the default discriminator derives from the content root path, which changes on every atomic release switch. Persisting keys in the database while letting the discriminator move produces keys that are stored but underivable — the same failure, quieter. A constant cannot be forgotten during a host migration or accidentally differ between two instances sharing a database.
|
||||
|
||||
**Rationale for BR-U2-03 and BR-U2-04**: this is the § 5.1 conflict. Because module registration runs after the host's, a module's bare `AddDataProtection()` would override the persistent store. `IDataProtector` still resolves, so registration tests pass — the defect appears only after the first release switch, as slave API keys that no longer decrypt.
|
||||
|
||||
**Rationale for BR-U2-06**: this is the single most destructive maintenance action available against this system. Pruning the keys table looks like harmless housekeeping and permanently breaks every Master↔slave relationship. It must be stated in the deployment documentation, not only in code comments (Q5 = C).
|
||||
|
||||
---
|
||||
|
||||
## Migration Rules
|
||||
|
||||
| ID | Rule |
|
||||
|---|---|
|
||||
| **BR-U2-09** | `ApplicationDbContext` migrations are applied automatically at startup, before the application accepts traffic. |
|
||||
| **BR-U2-10** | Core migrations run **before** module middleware installation, so the keys table exists before any module resolves an `IDataProtector`. |
|
||||
| **BR-U2-11** | A **connection** failure is retried with increasing delay, up to a bounded number of attempts. |
|
||||
| **BR-U2-12** | A **migration** failure — invalid, conflicting, or inapplicable — fails immediately with no retry. |
|
||||
| **BR-U2-13** | When retries are exhausted, or on a migration failure, the exception propagates and the process does not start. |
|
||||
| **BR-U2-14** | Before failing, the reason is logged with enough context to diagnose it — but never including the connection string, credentials, or any secret. |
|
||||
| **BR-U2-15** | `AvailabilityDbContext` and `MasterDbContext` keep their existing self-migration in `UseModule`. U2 does not change them. |
|
||||
| **BR-U2-16** | Migrations must be forward-compatible and non-destructive, so redeploying an earlier release remains a valid rollback. |
|
||||
|
||||
**Rationale for BR-U2-11 and BR-U2-12**: the two failures mean different things. On the Pi the application and SQL Server may start together after a reboot, so a brief unavailability window is normal operation, not a fault. A broken migration is a fault, and retrying it only delays the inevitable while filling the log.
|
||||
|
||||
**Rationale for BR-U2-13**: this is what gives U1's liveness check meaning. A process that starts regardless would report healthy while being unusable; strict startup makes the absence of a `/health` response a trustworthy signal.
|
||||
|
||||
**Rationale for BR-U2-16**: rollback is "redeploy the previous release" (D-26). That is only safe if the older code can run against the newer schema. A destructive migration — dropping a column, narrowing a type — makes rollback impossible precisely when it is most needed.
|
||||
|
||||
---
|
||||
|
||||
## Operational Constraint Rules
|
||||
|
||||
| ID | Rule |
|
||||
|---|---|
|
||||
| **BR-U2-17** | Exactly one application instance may migrate a given database at a time. Not enforced in code; documented as an operational constraint (Q4 = C). |
|
||||
| **BR-U2-18** | Each instance has its own database. The Master and each slave never share one. |
|
||||
|
||||
**Rationale**: `Database.Migrate()` is not safe under concurrency. Today the constraint holds by design — one instance per database — so a distributed lock would add failure modes without removing any. Should the deployment model ever change to multiple instances sharing a database, automatic startup migration must be revisited **before** that change is made.
|
||||
|
||||
---
|
||||
|
||||
## Error and Edge-Case Scenarios
|
||||
|
||||
| Scenario | Expected behaviour |
|
||||
|---|---|
|
||||
| Fresh database, no tables | All Core migrations applied, including the keys table; startup proceeds |
|
||||
| Database up to date | Migration is a no-op; startup proceeds |
|
||||
| Database unreachable at startup, comes up within the retry window | Retries succeed; startup proceeds; the delay is logged |
|
||||
| Database unreachable for the whole retry window | Logged, process does not start, `/health` silent, UptimeRobot red |
|
||||
| Migration conflicts with existing schema | Failed immediately, no retry, process does not start |
|
||||
| Credentials wrong | Treated as a connection failure — retried, then fails. Distinguishing bad credentials from an unreachable server is not worth the complexity; the outcome is identical |
|
||||
| Keys table empty on first run | Data Protection generates a key and persists it; normal first-run behaviour |
|
||||
| Keys table populated from a previous release | Existing keys are read; previously encrypted values remain readable — the purpose of the unit |
|
||||
| Release directory changed since last start | Irrelevant — the discriminator is a constant (BR-U2-02) |
|
||||
| Someone deletes rows from the keys table | Every value encrypted with those keys becomes permanently unreadable. Prevented by documentation only (BR-U2-06) |
|
||||
| Two instances start simultaneously against one database | Undefined. Prevented by the operational constraint (BR-U2-17), not by code |
|
||||
| A module still calls `AddDataProtection()` after this unit | The persistent store is silently overridden. Prevented by BR-U2-04 and asserted by a test |
|
||||
|
||||
---
|
||||
|
||||
## Security Compliance for U2
|
||||
|
||||
| Rule | Status | Notes |
|
||||
|---|---|---|
|
||||
| SECURITY-01 | **Partially compliant — DEV-05** | Encryption **in transit** enforced by BR-U2-08 (TLS on the connection). Encryption **at rest** for the keys themselves is deferred: keys are stored unencrypted, relying on the database's own at-rest encryption and network isolation. Accepted with a follow-up (Q2 = C) |
|
||||
| SECURITY-03 | Compliant | BR-U2-14 requires diagnostic context without secrets |
|
||||
| SECURITY-09 | Compliant | No default credentials; failure messages carry no connection details |
|
||||
| SECURITY-13 | **Improved** | The key ring surviving redeploys is precisely a software-integrity property: without it, the encrypted API keys that authenticate Master↔slave communication silently become invalid |
|
||||
| SECURITY-15 | Compliant | Fails closed — the process does not start rather than serving in an unknown schema state |
|
||||
|
||||
### New Documented Deviation
|
||||
|
||||
| ID | Deviation | Rationale | Decided |
|
||||
|---|---|---|---|
|
||||
| **DEV-05** | **Data Protection keys are stored unencrypted at rest.** SECURITY-01 requires encryption at rest for persisted data. | DPAPI is unavailable on Linux, and X.509 certificate encryption relocates the loss problem to the certificate — reintroducing the failure mode this unit exists to eliminate. Compensating controls: TLS on the database connection, and the database not publicly reachable (BR-U2-08). Certificate-based encryption is recorded as a separate follow-up item. | Q2 = C |
|
||||
+124
@@ -0,0 +1,124 @@
|
||||
# Domain Entities — U2 Data Durability
|
||||
|
||||
U2 adds **one** persisted entity and **one** migration. Everything else in the unit is configuration and startup behaviour.
|
||||
|
||||
---
|
||||
|
||||
## Entity Relationships
|
||||
|
||||
```mermaid
|
||||
graph TD
|
||||
appctx["ApplicationDbContext<br/>implements IDataProtectionKeyContext"]
|
||||
key["DataProtectionKey<br/>NEW"]
|
||||
user["ApplicationUser<br/>existing"]
|
||||
refresh["RefreshToken<br/>existing"]
|
||||
invite["Invitation<br/>existing"]
|
||||
avail["GlobalAvailabilityState<br/>existing"]
|
||||
protector["IDataProtector<br/>derived from keys"]
|
||||
cmsinst["CmsInstance<br/>MasterDbContext"]
|
||||
mastreg["MasterRegistration<br/>AvailabilityDbContext"]
|
||||
|
||||
appctx -->|"owns"| key
|
||||
appctx -->|"owns"| user
|
||||
appctx -->|"owns"| refresh
|
||||
appctx -->|"owns"| invite
|
||||
appctx -->|"owns"| avail
|
||||
key -->|"derives"| protector
|
||||
protector -->|"encrypts API key of"| cmsinst
|
||||
protector -->|"encrypts API key of"| mastreg
|
||||
|
||||
classDef ctx fill:#fbd38d,stroke:#c05621,stroke-width:1px,color:#000;
|
||||
classDef newent fill:#9ae6b4,stroke:#2f855a,stroke-width:1px,color:#000;
|
||||
classDef existing fill:#e2e8f0,stroke:#4a5568,stroke-width:1px,color:#000;
|
||||
classDef derived fill:#90cdf4,stroke:#2b6cb0,stroke-width:1px,color:#000;
|
||||
classDef consumer fill:#d6bcfa,stroke:#6b46c1,stroke-width:1px,color:#000;
|
||||
class appctx ctx;
|
||||
class key newent;
|
||||
class user,refresh,invite,avail existing;
|
||||
class protector derived;
|
||||
class cmsinst,mastreg consumer;
|
||||
```
|
||||
|
||||
Text alternative: the Core context gains a Data Protection keys table alongside its existing Identity entities; those keys derive the protector that encrypts the API keys stored on CMS instances and master registrations in the two module contexts.
|
||||
|
||||
**Cross-context dependency worth noting**: the keys live in `ApplicationDbContext`, while the values they protect live in `MasterDbContext` and `AvailabilityDbContext`. There is no foreign key between them — all three contexts share one database, but the relationship is behavioural, not relational. Losing the keys does not produce a referential-integrity error; it produces rows whose encrypted column can no longer be read. That is exactly why the failure is silent.
|
||||
|
||||
---
|
||||
|
||||
## DataProtectionKey (new)
|
||||
|
||||
Provided by the framework via `IDataProtectionKeyContext`; the schema is not authored by this project.
|
||||
|
||||
| Field | Type | Purpose |
|
||||
|---|---|---|
|
||||
| `Id` | int, identity | Primary key |
|
||||
| `FriendlyName` | string, nullable | Human-readable key identifier |
|
||||
| `Xml` | string | The serialized key material |
|
||||
|
||||
### Constraints and rules
|
||||
|
||||
| Aspect | Rule |
|
||||
|---|---|
|
||||
| Owning context | `ApplicationDbContext` (Q7 of Application Design = A) |
|
||||
| Migration | One new Core migration, applied automatically at startup by FR-11 |
|
||||
| Encryption at rest | **None** — see DEV-05. `Xml` contains usable key material in plain text |
|
||||
| Retention | Rows are **never** deleted (BR-U2-06) |
|
||||
| Rotation | Framework default, 90 days; new rows are added, old rows retained |
|
||||
| Access | Only through the Data Protection API. No application code reads or writes this table directly |
|
||||
|
||||
**Why `Xml` being plaintext matters**: anyone who can read this table can decrypt every stored slave API key. This is the substance of DEV-05, and why BR-U2-08 requires TLS on the connection and a database that is not publicly reachable. Those compensating controls are not optional extras — they are what makes the deviation acceptable.
|
||||
|
||||
---
|
||||
|
||||
## ApplicationDbContext (modified)
|
||||
|
||||
| Change | Detail |
|
||||
|---|---|
|
||||
| Interface | Implements `IDataProtectionKeyContext` |
|
||||
| New set | `DbSet<DataProtectionKey> DataProtectionKeys` |
|
||||
| Existing sets | Unchanged — Identity, `RefreshToken`, `Invitation`, `ModulePermission`, `GlobalAvailabilityState` |
|
||||
| Migration behaviour | **Changed**: now migrates automatically at startup (FR-11). Previously required a manual `dotnet ef database update` |
|
||||
|
||||
**Note on the behaviour change**: automatic migration is a genuine change in operational semantics, not merely a convenience. Previously a schema change reached production only when a human ran a command; now it happens whenever a new release starts. This is why forward-compatible, non-destructive migrations (BR-U2-16) and a pre-deploy backup (FR-20) are load-bearing rather than nice to have.
|
||||
|
||||
---
|
||||
|
||||
## Configuration Values
|
||||
|
||||
U2 introduces **no new `appsettings` section**.
|
||||
|
||||
| Value | Source | Rationale |
|
||||
|---|---|---|
|
||||
| Application discriminator | **Constant in code** | Q1 = A. Cannot be misconfigured, forgotten, or made to differ between instances sharing a database |
|
||||
| Key lifetime | Framework default (90 days) | Q5 = C. No reason to differ |
|
||||
| Migration retry attempts and delays | Constants in code | Values chosen to cover a host-reboot window; not an operational tuning knob |
|
||||
| Connection string | Existing `ConnectionStrings:DefaultConnection` | Unchanged. BR-U2-08 requires TLS to be enforced in it |
|
||||
|
||||
**Why nothing is configurable here**: every value in this unit exists to prevent a silent failure. A configuration surface would be a way to reintroduce that failure — a discriminator set wrong on one instance, or a key lifetime set so short that rotation outpaces retention.
|
||||
|
||||
---
|
||||
|
||||
## Persistence Summary
|
||||
|
||||
| Question | Answer |
|
||||
|---|---|
|
||||
| New tables? | One — the Data Protection keys table |
|
||||
| New migrations? | One, in `SlpModularCms.Core` |
|
||||
| Modified entities? | None. `ApplicationDbContext` gains a set but no existing entity changes |
|
||||
| Destructive schema changes? | None. Purely additive, so rollback by redeploying an earlier release stays safe |
|
||||
| New configuration? | None |
|
||||
|
||||
---
|
||||
|
||||
## Verification Targets
|
||||
|
||||
What this unit's tests must actually prove, given that the failure mode is silent:
|
||||
|
||||
| Target | Why it needs asserting |
|
||||
|---|---|
|
||||
| The persistent key store survives module registration | Registration alone passes in both the broken and fixed cases — only the resulting configuration distinguishes them |
|
||||
| The application discriminator is the fixed constant | The default would change per release directory, defeating persistence |
|
||||
| A protected value round-trips across a simulated content-root change | This is the actual user-visible property: an API key encrypted before a deploy is still readable after it |
|
||||
| Neither module registers Data Protection | Prevents the conflict from being reintroduced by a future change to either module |
|
||||
| A connection failure retries; a migration failure does not | The two paths differ deliberately (BR-U2-11, BR-U2-12) |
|
||||
| Both hosts still start | `SlpModularCms.Api.Slave` has no test project and is a reference instance (Q2 of Application Design = A) |
|
||||
Reference in New Issue
Block a user