wangbo
7376d6fab6
取消跨主体专属占用，按租户、用户组、用户、当前 API Key 和 scope 分层求交，并在任务落库前统一校验候选。\n\n增加旧 allow 规则归档清理迁移、脱敏审计工具和回滚运行手册，补齐主体隔离、deny 优先及列表与运行时一致性测试。
51 lines
3.6 KiB
JSON
51 lines
3.6 KiB
JSON
{
|
|
"version": 1,
|
|
"migrations": {
|
|
"apps/api/migrations/0090_oidc_multi_tenant_identity.sql": {
|
|
"sha256": "d5e67a0f92f4fe5fb64f5caceef0dd4733dc65f921e309bf4b3288522f6b4876",
|
|
"allowedViolations": [
|
|
"destructive DROP operation",
|
|
"non-null column addition"
|
|
],
|
|
"reason": "The migration replaces two existing constraints and one index with expanded definitions. Production preflight confirmed six schema-v1 identity revisions, no OIDC sessions or revocation watermarks, and small affected relations; the non-null columns use constant defaults."
|
|
},
|
|
"apps/api/migrations/0093_worker_instance_capacity_limit.sql": {
|
|
"sha256": "4b6a39ef90e7032555739ccf0568bf7ae0bce23ef98c3bee9c2c8e3bfa13291e",
|
|
"allowedViolations": [
|
|
"non-null column addition"
|
|
],
|
|
"reason": "The table stores ephemeral Worker heartbeats and currently has only two production rows. PostgreSQL adds the integer column with a constant default, then the migration backfills each live row from its existing allocation so a rolling deployment cannot assign unsafe failover capacity."
|
|
},
|
|
"apps/api/migrations/0095_oidc_session_context_identity.sql": {
|
|
"sha256": "3e6d17b5b564047c4a77ef3e4cf4ed88caba375a34a33bc7ecfbd7c59d6ab479",
|
|
"allowedViolations": [
|
|
"destructive DROP operation",
|
|
"non-null column addition"
|
|
],
|
|
"reason": "The migration adds only nullable session identity columns, backfills bound sessions, and replaces one CHECK constraint without dropping data. Production preflight on 2026-07-31 found zero gateway_oidc_sessions rows and a 48 KiB relation, so the constraint validation and metadata lock are bounded; the non-null finding comes from the new CHECK expression rather than a NOT NULL column addition."
|
|
},
|
|
"apps/api/migrations/0096_worker_capacity_controller.sql": {
|
|
"sha256": "52c2c5f31eaa61b96508ae9b2c9fa164e0f1544184c55a1ba85f64b9aca442cb",
|
|
"allowedViolations": [
|
|
"destructive DROP operation"
|
|
],
|
|
"reason": "The migration replaces only the existing Worker status CHECK constraint so a rolling deployment can mark lost instances stale. It does not drop data, columns, tables, or indexes; the old and new binaries both continue to read active and draining rows safely."
|
|
},
|
|
"apps/api/migrations/0101_worker_adaptive_load.sql": {
|
|
"sha256": "4a23a194b9244f0afe245ceb8ff47ee03ca7d3e732e5593f731380bdf3dd77ae",
|
|
"allowedViolations": [
|
|
"non-null column addition"
|
|
],
|
|
"reason": "The adaptive Worker columns use constant defaults on gateway_worker_instances, so PostgreSQL 18 can add them without rewriting the table. Production preflight on 2026-08-03 found 96 rows and a 180224-byte relation; the explicit backfill and constraint validation are therefore bounded. The only change to the 31899648-byte gateway_concurrency_leases relation is a nullable numeric column and a NOT VALID check followed by validation."
|
|
},
|
|
"apps/api/migrations/0102_access_rule_allow_whitelist_semantics.sql": {
|
|
"sha256": "7f65855237b7e5ae38b6d80228bf446e5c28eb22956272ced15c9f492b9aad40",
|
|
"allowedViolations": [
|
|
"procedural SQL body",
|
|
"DELETE FROM operation"
|
|
],
|
|
"reason": "This one-time semantic migration takes a write-blocking/read-compatible lock, records count and SHA-256 manifests, archives every legacy allow row, verifies the archive, and only then deletes legacy allows. Deny rows are checksummed before cleanup and verified unchanged afterward. The procedural blocks make any count or checksum mismatch abort the transaction; reapplying after new whitelist writes also fails before deleting them."
|
|
}
|
|
}
|
|
}
|