fix: don't allow runtime schema drops outside Development#61
Merged
Conversation
AutoCreate.All lets Marten drop and rewrite schema objects at runtime to match code, forcing the app's DB role to hold DDL rights and risking data loss on a code/database mismatch. Default AutoCreateSchemaObjects by environment instead: keep All for the Development inner loop, but use CreateOrUpdate (additive only, never drops) everywhere else. Add an AppFoundationOptions.SchemaCreation knob so a host can override — e.g. AutoCreate.None for a least-privilege role with schema provisioned out-of-band. Closes #53
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #53 (F4 — Marten
AutoCreate.Allruns schema DDL at runtime).What
AutoCreateSchemaObjectsis now chosen by environment:AutoCreate.Allin Development (fast inner loop, permits destructive rebuilds),AutoCreate.CreateOrUpdate(additive only — never drops or rewrites) everywhere else.AppFoundationOptions.SchemaCreation(AutoCreate?) lets a host override the default — most notablyAutoCreate.Nonefor a least-privilege deployment where the schema is provisioned out-of-band and the app's DB role has no DDL rights.Why
AutoCreate.Alllets Marten drop and rewrite schema objects at runtime to match code. That forces the running app's DB role to hold DDL privileges (against least-privilege) and risks data loss if the code/database shape diverges. Defaulting toCreateOrUpdateoutside Development removes the destructive behavior while keeping zero-ops schema provisioning; the opt-inNonesupports a fully locked-down role with an explicit migration step (db-apply/ a migration job /AddResourceSetupOnStartup).Because of
IntegrateWithWolverine(), the durable inbox/outbox tables are registered with Marten, so whichever mode is chosen also governs those tables.Tests
AddAppFoundationSchemaCreationTestscovers: non-Development →CreateOrUpdate, Development →All, and explicitSchemaCreationoverriding the environment default.Verification
dotnet build -c Release— 0 errors.dotnet test -c Release— 57/57 passing (3 new).main).