ChatGPT's update to harden software and run db updates.

2026-10-21 06:53:45 -04:00
parent 1e63076123
commit acc8cb70f5
171 changed files with 9325 additions and 404 deletions
@@ -0,0 +1,87 @@
+# Development tenant migration — October 20, 2026
+
+Completed against the authorized development target
+`192.168.1.190/huntingclubroster`, using the previously approved unencrypted
+development connection. No production service was changed.
+
+## Backup and restoration
+
+- Backup: `.tools/backups/20261020-173710/huntingclubroster.sql`.
+- Full dump with routines, events, triggers, 20 existing tables and a completion
+  footer; size **48,133 bytes**. Temporary connection credentials were removed.
+- SHA-256:
+  `4107de994758039a107ee449120463d3f2b21d8a7da705355fa940d6bf834ed8`.
+- Restored on the separate loopback test database server before migration;
+  all 20 table row counts matched the backup manifest. The local restoration
+  copy was subsequently removed and that server stopped.
+- Backup validation uses the bounded-tail validator. Backup files remain in the
+  ignored, web-denied `.tools` directory; the verification confirmed that the
+  private control file was inaccessible over HTTP.
+
+## Migration and owner promotion
+
+- Applied `bin/migrate-tenants.php` and `migrations/004_tenants.sql`.
+- Added `membership_role` and the invitations, tickets and ticket-message tables;
+  replaced the global unique club-name index with a normal index.
+- Explicitly promoted **james.richie@onesourceits.com** to
+  **Super System Administrator**.
+- Preserved its existing password and email-verification state. Incremented the
+  authentication version to revoke old sessions, invalidated the designated
+  account's outstanding reset/verification tokens, and added one promotion audit
+  entry. The one-time promotion environment variable was removed afterward.
+- Compared all original tables and original-column values, allowing only those
+  intended owner changes and the new audit entry. Original clubs, other accounts,
+  memberships and financial data were preserved.
+- No existing club-administrator assignments were guessed. The existing club
+  had no memberships before the migration and still has none; it is available
+  to the Super System Administrator for explicit setup.
+
+## Verification on the migrated development database
+
+**61 checks passed** using real HTTP handlers on a temporary loopback web server
+connected to the development database. Separate cookie/session clients signed
+in with seven randomly generated temporary accounts across two owned test clubs.
+No real account password was requested or changed, and no external email was sent.
+
+Verified:
+
+- Club administrators see all members/invitations of their shared club and cannot
+  view or modify another tenant through changed URLs, IDs or direct submissions.
+- Global user searches, account edits/deletion, password-reset requests, notes and
+  the journal are denied to club administrators, including attempts against the
+  real owner account.
+- Roster and financial exports are restricted to managed clubs, including CSV,
+  Excel, PDF and financial-history endpoints. Downloads contain only that club's
+  member data.
+- An administrator in one club who is an ordinary member of another gets only
+  ordinary member access in the second club.
+- Members see their own membership and dues, cannot see other members' contact
+  details, and cannot record payments or access an unassigned club.
+- A foreign dues ID cannot be paired with an authorized club. Recording a valid
+  payment updates only the intended member's balance.
+- Administrator invitations cannot be forged; matching verified accounts can
+  accept member invitations, and other accounts cannot steal them by ID.
+- Members can submit and read their own private tickets; other members and other
+  tenants cannot read them. Assigned administrators can respond and close tickets.
+  Ticket text is escaped when displayed.
+- Revoking a club administrator assignment removes management privileges on the
+  next request in the existing session.
+- Private verification credentials cannot be downloaded through the web server.
+
+Afterward, removed only the owned temporary clubs, accounts, memberships, dues,
+payment, invitation, ticket/messages, tagged audit entries and exact test rate
+limit records. Fingerprints across **all 23 tables** matched the post-migration,
+pre-test baseline before cleanup committed. The owner promotion and its audit
+record remain intact.
+
+Final health check passed. The development database contains its original
+**2 users, 1 club and 0 memberships**. The promoted owner can see the existing
+club. Temporary sessions and web server were removed/stopped.
+
+Protected evidence is retained beside the backup:
+`manifest.json`, `pre-tenant-snapshot.json`, `tenant-migration-result.json`,
+`tenant-acceptance-result.json`, `tenant-cleanup-result.json`, and
+`tenant-final-state.json`. The HTTP log is retained there as well.
+
+Sign in again using the owner's existing credentials, then assign the intended
+club administrators explicitly as described in [MULTI-TENANCY.md](MULTI-TENANCY.md).