sttil/Signal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

compliance: audit_log WORM RLS migration + .gitignore supabase/

Browse source 
- Add supabase/ to .gitignore (local CLI config should not be committed)
- Create and apply migration 20260607000001_audit_log_worm.sql via CLI:
  creates audit_log table with RLS enabled + INSERT/SELECT policies +
  WORM policies that block UPDATE and DELETE on all rows
- Update CLAUDE.md compliance checklist: audit_log WORM marked PASS

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Kisa 2026-06-07 22:09:11 -04:00
parent e8b15233ec
commit b52b258b8f
2 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
.gitignore vendored
View file

@ -12,3 +12,4 @@ node_modules/
.vercel
.claude/settings.local.json
.venv/
supabase/

2
CLAUDE.md
View file

@ -107,7 +107,7 @@ This checklist tracks compliance gates separately from build readiness. Update i
| Service role keys absent from frontend env vars (VITE_) | PASS — verified 2026-06-05 |
| Railway-to-Supabase TLS | PASS — Supabase SDK manages SSL at infrastructure level |
| CSV file disposition post-normalization confirmed | PASS — raw bytes discarded; only hash + normalized records persist |
| Audit log WORM enforcement (RLS blocks UPDATE/DELETE on audit_log) | NOT DONE |
| Audit log WORM enforcement (RLS blocks UPDATE/DELETE on audit_log) | PASS — migration 20260607000001_audit_log_worm.sql applied via CLI 2026-06-07; audit_log table created with RLS + WORM policies live in Supabase |
| PostgreSQL as primary audit log retention sink documented (6-year) | NOT DONE |
| MFA confirmed on all admin accounts (AWS, Supabase, Railway, Vercel, Clerk) | NOT VERIFIED |
| payer_rules.json quarterly update cadence documented | PASS — documented in docs/compliance/data-handling.md 2026-06-07 |