scripte/nexarch
1
0 Fork 0
Code Issues 1 Pull Requests 24 Actions 2 Packages Projects Releases Wiki Activity

ENG-07: technische-durchsetzung-append-only-fuer-das-instanzschritt-protokoll #326

Closed
patrick wants to merge 0 commits from feature/eng-07-technische-durchsetzung-append-only-f-r-das-instanzschritt-protokoll into main
pull from: feature/eng-07-technische-durchsetzung-append-only-f-r-das-instanzschritt-protokoll
merge into: scripte:main
Conversation 1 Commits - Files Changed -
patrick commented 2026-10-16 21:10:17 +02:00
Owner
Copy link
Copy source

AK1 PASS: TestHistoryRoleEnforcement_AppRoleHasNoUpdateOrDeletePrivilege -- UPDATE/DELETE mit nexarch_app-Rolle -> permission denied (42501).
AK2 PASS: TestHistoryRoleEnforcement_TamperAttemptIsLogged -- RAISE WARNING bei Aenderungsversuch per pgx.OnNotice bestaetigt.
AK3 PASS: bestehende ENG-04-Tests (Transition/History) weiterhin gruen.

Muster von Core AUD-07 / DMS VER-08 uebernommen (REVOKE + Trigger). Eigener Fund: workflow_instance_history.id ist BIGSERIAL (nicht UUID wie Vorbilder) -- zusaetzlicher GRANT USAGE ON SEQUENCE noetig, sonst scheitert normales INSERT der eingeschraenkten Rolle bereits an der Sequence. Hinweis: dieselbe Luecke besteht unveraendert in DMS VER-08 (audit_log_id_seq), dort bewusst nicht angefasst (eigenes Ticket noetig).

go build/vet/test sauber, Migrations-Rundlauf (Up/DownOne/Up) manuell verifiziert.

🤖 Generated with Claude Code

AK1 PASS: TestHistoryRoleEnforcement_AppRoleHasNoUpdateOrDeletePrivilege -- UPDATE/DELETE mit nexarch_app-Rolle -> permission denied (42501). AK2 PASS: TestHistoryRoleEnforcement_TamperAttemptIsLogged -- RAISE WARNING bei Aenderungsversuch per pgx.OnNotice bestaetigt. AK3 PASS: bestehende ENG-04-Tests (Transition/History) weiterhin gruen. Muster von Core AUD-07 / DMS VER-08 uebernommen (REVOKE + Trigger). Eigener Fund: workflow_instance_history.id ist BIGSERIAL (nicht UUID wie Vorbilder) -- zusaetzlicher GRANT USAGE ON SEQUENCE noetig, sonst scheitert normales INSERT der eingeschraenkten Rolle bereits an der Sequence. Hinweis: dieselbe Luecke besteht unveraendert in DMS VER-08 (audit_log_id_seq), dort bewusst nicht angefasst (eigenes Ticket noetig). go build/vet/test sauber, Migrations-Rundlauf (Up/DownOne/Up) manuell verifiziert. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
patrick added 1 commit 2026-10-16 21:10:17 +02:00
ENG-07: technische-durchsetzung-append-only-fuer-das-instanzschritt-protokoll
CI / Web-Barrierefreiheitspruefung (axe, Tastatur, Reflow, Textabstaende) (push) Canceled after 0s
Details
CI / Web-Barrierefreiheitspruefung (axe, Tastatur, Reflow, Textabstaende) (pull_request) Canceled after 0s
Details
CI / Core-Modul (Build/Vet/Test) (pull_request) Canceled after 0s
Details
CI / Core-Modul (Build/Vet/Test) (push) Canceled after 0s
Details
CI / DMS Security-Test-Gate (AC5, Merge-Gate) (push) Canceled after 0s
Details
CI / Connect Security-Test-Gate (QA-01 AC4, Merge-Gate) (push) Canceled after 0s
Details
CI / DMS-Modul Supply-Chain-Scan (govulncheck) (push) Canceled after 0s
Details
CI / Web (dms-browser) (push) Canceled after 0s
Details
CI / Web (pdf-viewer) (push) Canceled after 0s
Details
CI / Web (shl) (push) Canceled after 0s
Details
Supply-Chain-Scan (Go) / govulncheck (push) Canceled after 0s
Details
CI / DMS Security-Test-Gate (AC5, Merge-Gate) (pull_request) Canceled after 0s
Details
CI / Connect Security-Test-Gate (QA-01 AC4, Merge-Gate) (pull_request) Canceled after 0s
Details
CI / DMS-Modul Supply-Chain-Scan (govulncheck) (pull_request) Canceled after 0s
Details
CI / Web (dms-browser) (pull_request) Canceled after 0s
Details
CI / Web (pdf-viewer) (pull_request) Canceled after 0s
Details
CI / Web (shl) (pull_request) Canceled after 0s
Details
Core-Schnittstellen-Vertragstests / contract-tests (pull_request) Canceled after 0s
Details
Supply-Chain-Scan (Go) / govulncheck (pull_request) Canceled after 0s
Details
Supply-Chain-Scan (npm) / npm-audit (pull_request) Canceled after 0s
Details
Core-Pflichttest-Gate / pflichttest-gate (pull_request) Canceled after 0s
Details
RBAC-Rollenhierarchie-Pflichtgate / rbac-policy-invariant (pull_request) Canceled after 0s
Details
CI / DMS-Modul (Lint/Build/Test/Coverage/Artefakt) (push) Canceled after 0s
Details
CI / DMS-Modul (Lint/Build/Test/Coverage/Artefakt) (pull_request) Canceled after 0s
Details
e481b73378 
Analog zu Core AUD-07 und DMS VER-08: der Anwendungs-Datenbankrolle
(nexarch_app) werden UPDATE/DELETE-Rechte auf workflow_instance_history
entzogen (nur INSERT/SELECT), der bestehende ENG-04-Trigger protokolliert
abgelehnte Aenderungsversuche zusaetzlich per RAISE WARNING.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
patrick commented 2026-10-19 12:29:50 +02:00
Author
Owner
Copy link
Copy source

Inhalt bereits in main enthalten (geprueft per merge_all_prs.sh: leerer Merge-Diff). Geschlossen ohne Merge.

Inhalt bereits in main enthalten (geprueft per merge_all_prs.sh: leerer Merge-Diff). Geschlossen ohne Merge.
patrick closed this pull request 2026-10-19 12:29:50 +02:00

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
patrick
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: scripte/nexarch#326