Access control, MySQL accounts, TLS, GitHub credentials, and audit rules
Only a fresh systemAdmin session can start an inventory, refresh, or connection-verification
workflow. A fresh session is not older than 15 minutes. An impersonated session cannot use these
actions.
The administrator page must use the existing origin, session, and authorization controls. Every server action and route must repeat the authorization check.
The inventory result is the trusted source for a later selection. The refresh action must reject database names that are absent from that result. The refresh workflow must check visibility again before it opens a database connection. A forged form value must never become a database identifier.
Rackspace connection settings exist only in the Vercel production environment. In every other environment, the administrator page must show a clear not-configured state and disable each workflow action.
The existing security audit log records every inventory, refresh, download, approval, rejection, expiry, verification, artifact cleanup, branch cleanup, and manual lease-clear event. An expiry event has no user actor.
Add these allowlisted event names:
rackspace.inventory.startrackspace.refresh.startrackspace.review.downloadrackspace.review.approverackspace.review.rejectrackspace.review.expirerackspace.cleanup.authorizerackspace.artifact.cleanuprackspace.branch.cleanuprackspace.verify.startrackspace.lease.clearAudit metadata contains the operation ID, counts, action result, and safe error code. It does not contain database DDL, credentials, hostnames, account names, or raw errors.
A state-changing action writes its audit event and state change in one application-database transaction. The action fails closed if that transaction cannot write the audit event. An artifact download writes its audit event before it reads the encrypted artifact. The route fails closed if it cannot write that event.
Use separate snapshot and runtime accounts. Store their deployed connection values only in the Vercel Production environment through the environment values. The local probe receives all credential values through masked, paste-enabled prompts and does not store them.
The status record owns the safe evidence index. The local probe stores sensitive evidence outside the repository. Raw account names, grants, hostnames, and credentials never enter these documents.
The snapshot account receives the smallest grants that MySQL requires for each metadata statement. MySQL does not offer a pure metadata privilege for every statement. Some required grants carry capabilities beyond metadata reads. This table records the minimum grants and their residual capabilities:
| Statement | Minimum MySQL privileges | Residual capability |
|---|---|---|
SHOW DATABASES (visible set) | At least one privilege per database | None |
information_schema metadata reads | At least one privilege per object | None |
SHOW CREATE TABLE | At least one privilege for the table | Depends on the chosen grant |
SHOW CREATE VIEW | SHOW VIEW and SELECT on the view | Row reads through the view |
SHOW CREATE TRIGGER | TRIGGER on the subject table | Trigger create and drop |
SHOW CREATE PROCEDURE or FUNCTION | Global SHOW_ROUTINE (MySQL ≥ 8.0.20) | None |
SHOW CREATE EVENT | EVENT on the database | Event create, alter, drop |
The snapshot account must not have SELECT on base tables. It must not have data-change or
grant-management privileges. The residual capabilities in the table are accepted risks. A reviewer
must accept the final grant list before the account is created.
If the installed MySQL version does not support SHOW_ROUTINE, routine discovery needs a
version-specific alternative. The implementation must resolve that alternative during Step 0
version discovery.
SHOW CREATE VIEW requires SELECT on each view. Add the view grants before the next inventory
after a new view appears. Record that grant update in the next protected evidence report.
An administrator must compare the snapshot inventory with an authoritative inventory. MySQL shows only objects that the account can access. A successful metadata query does not prove completeness.
The runtime account permits the data operations that the application requires. These operations
are SELECT, INSERT, UPDATE, and DELETE. The account must not create, alter, or remove
schema objects. It must not manage grants or create a migration ledger.
Database-level grants apply to every table in a database. A table-level exclusion for a possible migration-ledger table is brittle and breaks on each schema change. Discovery must record whether a selected database contains a migration-ledger table. If one exists, record its data exposure as an accepted risk instead of a grant exclusion.
Rackspace must grant the narrowest privileges that satisfy each account. The implementation must validate the exact grants against the installed MySQL version.
The workflow and runtime package must never write connection settings, credentials, or complete database errors to logs or pull-request text.
The MySQL client must use TLS and normal public certificate validation. It must reject an invalid certificate or hostname.
Rackspace must allow only the configured Vercel Static IP addresses. The firewall must not expose MySQL to unrestricted public traffic.
The Vercel function region must match the configured Static IP region. A production connection probe must verify the effective egress address before the first inventory.
Static IPs apply to the complete Vercel project. The deployment review must account for this project-wide network setting.
@concourse/rsdb must accept explicit connection settings from its server-side caller. The
package must not read application environment variables. It must reject a configuration that
disables TLS.
Create a Vercel Connect GitHub connector for this use case. Link the connector only to the
concourse Production environment.
The connector installation must have access only to the Concourse repository. Its app token needs
Contents: write and Pull requests: write repository permissions.
Each operation requests an app-subject token for conveyal/concourse. The tracer requests only
contents:write. Publication requests contents:write and pull_requests:write.
Vercel Connect manages token issue, expiry, and refresh. Workflow arguments and results never contain the token.
Access control, MySQL accounts, TLS, GitHub credentials, and audit rules
Only a fresh systemAdmin session can start an inventory, refresh, or connection-verification
workflow. A fresh session is not older than 15 minutes. An impersonated session cannot use these
actions.
The administrator page must use the existing origin, session, and authorization controls. Every server action and route must repeat the authorization check.
The inventory result is the trusted source for a later selection. The refresh action must reject database names that are absent from that result. The refresh workflow must check visibility again before it opens a database connection. A forged form value must never become a database identifier.
Rackspace connection settings exist only in the Vercel production environment. In every other environment, the administrator page must show a clear not-configured state and disable each workflow action.
The existing security audit log records every inventory, refresh, download, approval, rejection, expiry, verification, artifact cleanup, branch cleanup, and manual lease-clear event. An expiry event has no user actor.
Add these allowlisted event names:
rackspace.inventory.startrackspace.refresh.startrackspace.review.downloadrackspace.review.approverackspace.review.rejectrackspace.review.expirerackspace.cleanup.authorizerackspace.artifact.cleanuprackspace.branch.cleanuprackspace.verify.startrackspace.lease.clearAudit metadata contains the operation ID, counts, action result, and safe error code. It does not contain database DDL, credentials, hostnames, account names, or raw errors.
A state-changing action writes its audit event and state change in one application-database transaction. The action fails closed if that transaction cannot write the audit event. An artifact download writes its audit event before it reads the encrypted artifact. The route fails closed if it cannot write that event.
Use separate snapshot and runtime accounts. Store their deployed connection values only in the Vercel Production environment through the environment values. The local probe receives all credential values through masked, paste-enabled prompts and does not store them.
The status record owns the safe evidence index. The local probe stores sensitive evidence outside the repository. Raw account names, grants, hostnames, and credentials never enter these documents.
The snapshot account receives the smallest grants that MySQL requires for each metadata statement. MySQL does not offer a pure metadata privilege for every statement. Some required grants carry capabilities beyond metadata reads. This table records the minimum grants and their residual capabilities:
| Statement | Minimum MySQL privileges | Residual capability |
|---|---|---|
SHOW DATABASES (visible set) | At least one privilege per database | None |
information_schema metadata reads | At least one privilege per object | None |
SHOW CREATE TABLE | At least one privilege for the table | Depends on the chosen grant |
SHOW CREATE VIEW | SHOW VIEW and SELECT on the view | Row reads through the view |
SHOW CREATE TRIGGER | TRIGGER on the subject table | Trigger create and drop |
SHOW CREATE PROCEDURE or FUNCTION | Global SHOW_ROUTINE (MySQL ≥ 8.0.20) | None |
SHOW CREATE EVENT | EVENT on the database | Event create, alter, drop |
The snapshot account must not have SELECT on base tables. It must not have data-change or
grant-management privileges. The residual capabilities in the table are accepted risks. A reviewer
must accept the final grant list before the account is created.
If the installed MySQL version does not support SHOW_ROUTINE, routine discovery needs a
version-specific alternative. The implementation must resolve that alternative during Step 0
version discovery.
SHOW CREATE VIEW requires SELECT on each view. Add the view grants before the next inventory
after a new view appears. Record that grant update in the next protected evidence report.
An administrator must compare the snapshot inventory with an authoritative inventory. MySQL shows only objects that the account can access. A successful metadata query does not prove completeness.
The runtime account permits the data operations that the application requires. These operations
are SELECT, INSERT, UPDATE, and DELETE. The account must not create, alter, or remove
schema objects. It must not manage grants or create a migration ledger.
Database-level grants apply to every table in a database. A table-level exclusion for a possible migration-ledger table is brittle and breaks on each schema change. Discovery must record whether a selected database contains a migration-ledger table. If one exists, record its data exposure as an accepted risk instead of a grant exclusion.
Rackspace must grant the narrowest privileges that satisfy each account. The implementation must validate the exact grants against the installed MySQL version.
The workflow and runtime package must never write connection settings, credentials, or complete database errors to logs or pull-request text.
The MySQL client must use TLS and normal public certificate validation. It must reject an invalid certificate or hostname.
Rackspace must allow only the configured Vercel Static IP addresses. The firewall must not expose MySQL to unrestricted public traffic.
The Vercel function region must match the configured Static IP region. A production connection probe must verify the effective egress address before the first inventory.
Static IPs apply to the complete Vercel project. The deployment review must account for this project-wide network setting.
@concourse/rsdb must accept explicit connection settings from its server-side caller. The
package must not read application environment variables. It must reject a configuration that
disables TLS.
Create a Vercel Connect GitHub connector for this use case. Link the connector only to the
concourse Production environment.
The connector installation must have access only to the Concourse repository. Its app token needs
Contents: write and Pull requests: write repository permissions.
Each operation requests an app-subject token for conveyal/concourse. The tracer requests only
contents:write. Publication requests contents:write and pull_requests:write.
Vercel Connect manages token issue, expiry, and refresh. Workflow arguments and results never contain the token.