feat: add least-privilege SQL runtime role (#924)

Author: johlju

.devcontainer/.env.example

@@ -12,21 +12,30 @@ MSSQL_SA_PASSWORD=YourStrong!Passw0rd
 SQLSERVER_HOST_PORT=1433
 
 DATABASE_READONLY_PASSWORD_ENV=DB_READONLY_PASSWORD
+DB_BOOTSTRAP_ADMIN_PASSWORD=YourStrong!Passw0rd
+DB_BOOTSTRAP_ADMIN_USER=sa
+DB_BOOTSTRAP_APP_PASSWORD=RuntimeOnly!Passw0rd7
+DB_BOOTSTRAP_APP_USER=kravhantering_app
 DB_ENCRYPT=true
 DB_HOST=db
+DB_MIGRATION_PASSWORD=MigrationOnly!Passw0rd7
+DB_MIGRATION_USER=kravhantering_job
 DB_NAME=kravhantering
+DB_PASSWORD=RuntimeOnly!Passw0rd7
 DB_PORT=1433
 DB_READONLY_PASSWORD=BrowseOnly!Passw0rd7
 DB_READONLY_USER=readonly
+DB_RUNTIME_USER=kravhantering_app
 DB_TRUST_SERVER_CERTIFICATE=true
+DB_USER=kravhantering_app
 DOTNET_CLI_TELEMETRY_OPTOUT=1
 DOTNET_CLI_WORKLOAD_UPDATE_NOTIFY_DISABLE=true
 DOTNET_SKIP_WORKLOAD_INTEGRITY_CHECK=true
 NEXT_TELEMETRY_DISABLED=1
 NODE_ENV=development
 
 # Optional explicit overrides for the derived DB_* connection settings above:
-# DATABASE_URL=mssql://sa:YourStrong!Passw0rd@db:1433/kravhantering?encrypt=true&trustServerCertificate=true
+# DATABASE_URL=mssql://kravhantering_app:RuntimeOnly!Passw0rd7@db:1433/kravhantering?encrypt=true&trustServerCertificate=true
 # DATABASE_READONLY_URL=mssql://readonly:BrowseOnly!Passw0rd7@db:1433/kravhantering?encrypt=true&trustServerCertificate=true
 
 # Local OIDC IdP (Keycloak) — consumed by the `idp` service in the

.env.development

@@ -6,17 +6,26 @@
 # below are intentionally well-known, non-production placeholders that match
 # the committed Keycloak realm JSON in dev/keycloak/.
 
+DB_BOOTSTRAP_ADMIN_PASSWORD=YourStrong!Passw0rd
+DB_BOOTSTRAP_ADMIN_USER=sa
+DB_BOOTSTRAP_APP_PASSWORD=RuntimeOnly!Passw0rd7
+DB_BOOTSTRAP_APP_USER=kravhantering_app
 DB_ENCRYPT=true
 # Local SQL Server defaults for host-based development.
 # The devcontainer injects its own DB_* values from `.devcontainer/.env`,
 # and those existing shell variables take precedence over these committed
 # defaults when the app runs inside the container.
 DB_HOST=127.0.0.1
+DB_MIGRATION_PASSWORD=MigrationOnly!Passw0rd7
+DB_MIGRATION_USER=kravhantering_job
 DB_NAME=kravhantering
+DB_PASSWORD=RuntimeOnly!Passw0rd7
 DB_PORT=1433
 DB_READONLY_PASSWORD=BrowseOnly!Passw0rd7
 DB_READONLY_USER=readonly
+DB_RUNTIME_USER=kravhantering_app
 DB_TRUST_SERVER_CERTIFICATE=true
+DB_USER=kravhantering_app
 MSSQL_SA_PASSWORD=YourStrong!Passw0rd
 
 NEXT_PUBLIC_SITE_URL=http://localhost:3000

.env.example

@@ -70,6 +70,7 @@ DATABASE_URL=mssql://sa:YourStrong!Passw0rd@127.0.0.1:1433/kravhantering?encrypt
 # MSSQL_SA_PASSWORD=YourStrong!Passw0rd
 # DB_READONLY_USER=readonly
 # DB_READONLY_PASSWORD=BrowseOnly!Passw0rd7
+# DB_RUNTIME_USER=kravhantering_app
 # DB_ENCRYPT=true
 # DB_TRUST_SERVER_CERTIFICATE=true
 

.env.sqlserver.example

@@ -19,6 +19,7 @@ DB_NAME=kravhantering
 DB_PORT=1433
 DB_READONLY_PASSWORD=BrowseOnly!Passw0rd7
 DB_READONLY_USER=readonly
+DB_RUNTIME_USER=kravhantering_app
 DB_TRUST_SERVER_CERTIFICATE=true
 
 # Optional explicit overrides for the derived DB_* connection settings above:

containers/app/Dockerfile

@@ -95,6 +95,7 @@ COPY --from=db-job-dependencies --chown=node:node /workspace/node_modules ./node
 COPY --chown=node:node package.json package-lock.json ./
 COPY --chown=node:node scripts/db-sqlserver-admin.mjs ./scripts/db-sqlserver-admin.mjs
 COPY --chown=node:node typeorm/migrations ./typeorm/migrations
+COPY --chown=node:node typeorm/runtime-permission-manifest.mjs ./typeorm/runtime-permission-manifest.mjs
 COPY --chown=node:node typeorm/seed-required.mjs ./typeorm/seed-required.mjs
 COPY --chown=node:node typeorm/ai-safety-seed-data.mjs ./typeorm/ai-safety-seed-data.mjs
 COPY --chown=node:node typeorm/seed-runner.mjs ./typeorm/seed-runner.mjs
@@ -118,6 +119,7 @@ COPY --from=db-job-dependencies --chown=node:node /workspace/node_modules ./node
 COPY --chown=node:node package.json package-lock.json ./
 COPY --chown=node:node scripts/db-sqlserver-admin.mjs ./scripts/db-sqlserver-admin.mjs
 COPY --chown=node:node typeorm/migrations ./typeorm/migrations
+COPY --chown=node:node typeorm/runtime-permission-manifest.mjs ./typeorm/runtime-permission-manifest.mjs
 COPY --chown=node:node typeorm/seed-required.mjs ./typeorm/seed-required.mjs
 COPY --chown=node:node typeorm/ai-safety-seed-data.mjs ./typeorm/ai-safety-seed-data.mjs
 COPY --chown=node:node typeorm/seed-runner.mjs ./typeorm/seed-runner.mjs

containers/db-job/.env.db-job.example

@@ -16,5 +16,6 @@ DB_PORT=1433
 DB_READONLY_PASSWORD=BrowseOnly!Passw0rd7
 DB_READONLY_USER=readonly
 DB_REQUEST_TIMEOUT_MS=30000
+DB_RUNTIME_USER=kravhantering_app
 DB_TRUST_SERVER_CERTIFICATE=true
 DB_USER=kravhantering_job

containers/db-job/README.md

@@ -24,12 +24,19 @@ npm run container:build:db-job
 The image entrypoint is `node scripts/db-sqlserver-admin.mjs`, so Compose or
 manual runs pass the admin command as arguments:
 
-- `bootstrap` creates the database plus the app and job SQL principals.
+- `bootstrap` creates the database plus distinct app and job SQL principals,
+  their `dbo` default schema, and the `kravhantering_runtime` role membership.
+  Password rotation is outside this command's scope.
 - `migration-status` prints JSON evidence with expected, observed, pending and
   unknown TypeORM migrations without modifying the database.
-- `migrate` applies TypeORM migrations.
+- `migrate` applies TypeORM migrations, reconciles the runtime permission
+  manifest, and fails if grants or managed-user membership do not verify.
 - `migrate --json` applies TypeORM migrations and prints the preflight,
-  applied migration and post-migration evidence as JSON.
+  migration execution, final migration status, and runtime-permission evidence
+  as JSON.
+- `permission-status` prints secret-free JSON evidence without changing state.
+- `permission-reconcile` reapplies the manifest and managed memberships, then
+  prints the verified JSON status.
 - `seed:required` applies only required system and lookup seed data.
 - `health` runs a simple SQL Server read check.
 - `wait` polls SQL Server until it responds.
@@ -39,6 +46,25 @@ A production-like empty database is bootstrap, migration, and
 its required seed helper modules, and excludes `typeorm/seed.mjs`, dogfood
 seed, archiving-retention demo seed, tests, and documentation.
 
+[`runtime-permission-manifest.mjs`](../../typeorm/runtime-permission-manifest.mjs)
+is the release-versioned authority for exact object, operation, and
+column-scoped grants. New objects require manifest inclusion for access through
+the custom `kravhantering_runtime` role. Within the custom role, the runtime can
+read but not write `dbo.migrations`; protected audit and review tables have
+narrower insert, update-column, and delete boundaries. The reconciler removes
+unexpected direct permissions from the project role. For every managed runtime
+user, it establishes and verifies the custom grants and membership. If that
+user also belongs to `db_datareader` or `db_datawriter`, the reconciler removes
+those broad memberships only after the custom contract verifies. It does not
+modify other user roles, direct user grants, or site-owned extension-role
+memberships. Verification nevertheless fails when those permissions give a
+managed runtime user effective schema-migration or protected-audit mutation
+access. Custom-role parent nesting also fails verification for an operator to
+resolve explicitly. Migrations and required seed continue to use the separate
+db-job login with `db_owner`. Reconciliation, broad-role removal, and final
+effective-permission verification commit as one transaction; a final failure
+leaves no partial permission or membership changes.
+
 The image installs only the dependency subset needed by the one-shot job:
 `mssql`, `typeorm`, and `reflect-metadata`. It deliberately does not include
 the Next.js application dependency tree.
@@ -53,6 +79,10 @@ Required values:
 
 - `DB_HOST`, `DB_PORT`, `DB_NAME`, `DB_USER`, and `DB_PASSWORD` select the
   SQL Server database used for migrations and required seed data.
+- `DB_RUNTIME_USER` names the application runtime database user whose custom-role
+  membership must verify. It is non-secret and never authorizes login creation,
+  password rotation, or a runtime connection. Additional managed users may be
+  listed comma-separated in `DB_RUNTIME_USERS`.
 - `DB_ENCRYPT` and `DB_TRUST_SERVER_CERTIFICATE` configure the SQL Server TLS
   connection.
 - `DB_CONNECTION_TIMEOUT_MS` and `DB_REQUEST_TIMEOUT_MS` bound database

containers/production/env/db-job.env.template

@@ -1,17 +1,17 @@
 # db-job SQL Server client timeouts: opening connections and running SQL.
+# Only set DB_BOOTSTRAP_* for the controlled bootstrap alternative or internal
+# single-node topology. Remove them for DBA-pre-provisioned production use.
+DB_BOOTSTRAP_ADMIN_PASSWORD=replace-with-temporary-sql-admin-password
+DB_BOOTSTRAP_ADMIN_USER=sa
+DB_BOOTSTRAP_APP_PASSWORD=replace-with-app-db-password
+DB_BOOTSTRAP_APP_USER=kravhantering_app
 DB_CONNECTION_TIMEOUT_MS=15000
-DB_REQUEST_TIMEOUT_MS=30000
 DB_ENCRYPT=true
 DB_HOST=sqlserver.example.internal
 DB_NAME=kravhantering
 DB_PASSWORD=replace-with-db-job-password
 DB_PORT=1433
+DB_REQUEST_TIMEOUT_MS=30000
+DB_RUNTIME_USER=kravhantering_app
 DB_TRUST_SERVER_CERTIFICATE=false
 DB_USER=kravhantering_job
-
-# Only set these for the controlled bootstrap alternative or the internal
-# single-node variant. Remove them for DBA-pre-provisioned production use.
-DB_BOOTSTRAP_ADMIN_PASSWORD=replace-with-temporary-sql-admin-password
-DB_BOOTSTRAP_ADMIN_USER=sa
-DB_BOOTSTRAP_APP_PASSWORD=replace-with-app-db-password
-DB_BOOTSTRAP_APP_USER=kravhantering_app

containers/production/sqlserver/dba-provision.sql.template

@@ -1,11 +1,11 @@
 /*
-  cSpell:words datawriter
-
   SQL Server pre-provisioning template for the external database path.
 
   Replace every value in angle brackets before running. The migration/job
   principal needs db_owner because TypeORM migrations create and alter schema.
-  The app principal needs read/write data roles for normal runtime traffic.
+  The db-job reconciles the custom runtime role's release-versioned grants when
+  migration completes; this template owns principals and initial membership only.
+  The app principal receives only the custom runtime role.
 */
 
 USE [master];
@@ -36,29 +36,30 @@ GO
 
 IF DATABASE_PRINCIPAL_ID(N'<db-job-login>') IS NULL
 BEGIN
-  CREATE USER [<db-job-login>] FOR LOGIN [<db-job-login>];
+  CREATE USER [<db-job-login>] FOR LOGIN [<db-job-login>]
+    WITH DEFAULT_SCHEMA = [dbo];
 END
+ALTER USER [<db-job-login>] WITH DEFAULT_SCHEMA = [dbo];
 GO
 
 IF DATABASE_PRINCIPAL_ID(N'<app-login>') IS NULL
 BEGIN
-  CREATE USER [<app-login>] FOR LOGIN [<app-login>];
+  CREATE USER [<app-login>] FOR LOGIN [<app-login>]
+    WITH DEFAULT_SCHEMA = [dbo];
 END
+ALTER USER [<app-login>] WITH DEFAULT_SCHEMA = [dbo];
 GO
 
-IF NOT EXISTS (
+IF EXISTS (
   SELECT 1
-  FROM sys.database_role_members AS members
-  INNER JOIN sys.database_principals AS roles
-    ON members.role_principal_id = roles.principal_id
-  INNER JOIN sys.database_principals AS principals
-    ON members.member_principal_id = principals.principal_id
-  WHERE roles.name = N'db_owner'
-    AND principals.name = N'<db-job-login>'
+  FROM sys.database_principals
+  WHERE [name] = N'kravhantering_runtime'
+    AND [type] <> N'R'
 )
-BEGIN
-  ALTER ROLE [db_owner] ADD MEMBER [<db-job-login>];
-END
+  THROW 51021, 'Cannot provision kravhantering_runtime: a non-role database principal uses that name.', 1;
+
+IF DATABASE_PRINCIPAL_ID(N'kravhantering_runtime') IS NULL
+  CREATE ROLE [kravhantering_runtime] AUTHORIZATION [dbo];
 
 IF NOT EXISTS (
   SELECT 1
@@ -67,11 +68,11 @@ IF NOT EXISTS (
     ON members.role_principal_id = roles.principal_id
   INNER JOIN sys.database_principals AS principals
     ON members.member_principal_id = principals.principal_id
-  WHERE roles.name = N'db_datareader'
-    AND principals.name = N'<app-login>'
+  WHERE roles.name = N'db_owner'
+    AND principals.name = N'<db-job-login>'
 )
 BEGIN
-  ALTER ROLE [db_datareader] ADD MEMBER [<app-login>];
+  ALTER ROLE [db_owner] ADD MEMBER [<db-job-login>];
 END
 
 IF NOT EXISTS (
@@ -81,10 +82,10 @@ IF NOT EXISTS (
     ON members.role_principal_id = roles.principal_id
   INNER JOIN sys.database_principals AS principals
     ON members.member_principal_id = principals.principal_id
-  WHERE roles.name = N'db_datawriter'
+  WHERE roles.name = N'kravhantering_runtime'
     AND principals.name = N'<app-login>'
 )
 BEGIN
-  ALTER ROLE [db_datawriter] ADD MEMBER [<app-login>];
+  ALTER ROLE [kravhantering_runtime] ADD MEMBER [<app-login>];
 END
 GO

cspell.jsonc

@@ -386,7 +386,9 @@
     "executesql",
     "recordset",
     "recordsets",
+    "rolemember",
     "datareader",
+    "datawriter",
     "Millis",
     "analysability",
     "acceptanskriterie",