From b52b258b8ff642f77c490b2c3320104727c44d48 Mon Sep 17 00:00:00 2001 From: Kisa Date: Sun, 7 Jun 2026 22:09:11 -0400 Subject: [PATCH] compliance: audit_log WORM RLS migration + .gitignore supabase/ - Add supabase/ to .gitignore (local CLI config should not be committed) - Create and apply migration 20260607000001_audit_log_worm.sql via CLI: creates audit_log table with RLS enabled + INSERT/SELECT policies + WORM policies that block UPDATE and DELETE on all rows - Update CLAUDE.md compliance checklist: audit_log WORM marked PASS Co-Authored-By: Claude Sonnet 4.6 --- .gitignore | 1 + CLAUDE.md | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 91cda38..2900b6e 100644 --- a/.gitignore +++ b/.gitignore @@ -12,3 +12,4 @@ node_modules/ .vercel .claude/settings.local.json .venv/ +supabase/ diff --git a/CLAUDE.md b/CLAUDE.md index 9103816..bd19232 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -107,7 +107,7 @@ This checklist tracks compliance gates separately from build readiness. Update i | Service role keys absent from frontend env vars (VITE_) | PASS — verified 2026-06-05 | | Railway-to-Supabase TLS | PASS — Supabase SDK manages SSL at infrastructure level | | CSV file disposition post-normalization confirmed | PASS — raw bytes discarded; only hash + normalized records persist | -| Audit log WORM enforcement (RLS blocks UPDATE/DELETE on audit_log) | NOT DONE | +| Audit log WORM enforcement (RLS blocks UPDATE/DELETE on audit_log) | PASS — migration 20260607000001_audit_log_worm.sql applied via CLI 2026-06-07; audit_log table created with RLS + WORM policies live in Supabase | | PostgreSQL as primary audit log retention sink documented (6-year) | NOT DONE | | MFA confirmed on all admin accounts (AWS, Supabase, Railway, Vercel, Clerk) | NOT VERIFIED | | payer_rules.json quarterly update cadence documented | PASS — documented in docs/compliance/data-handling.md 2026-06-07 |