-
Notifications
You must be signed in to change notification settings - Fork 0
Troubleshooting
Check for:
- missing or weak signing keys;
- missing token-hashing keys;
- missing password pepper;
- missing dedicated rate-limit partition key;
- reused secret material;
- insecure production
BaseUri; - invalid cookie configuration;
- incomplete OIDC provider settings;
- missing selected-provider connection configuration.
Production validation intentionally fails closed.
- Confirm exactly one supported provider is registered.
- Verify the connection string or host-managed data source.
- Verify the database principal has the permissions required for the selected migration mode.
- Check migration serialization and ledger status.
- For PostgreSQL, confirm the approved scratch/production server is reachable and TLS/timeout policy is correct.
- For SQLite, verify directory permissions and that the DB is not on a network filesystem.
Use the migration tool’s status and validate commands through the PowerShell wrapper.
Check:
- token algorithm and
kid; - issuer, audience, lifetime, and clock skew;
- account active state;
- security version;
- authorization version;
- tenant membership for tenant-scoped tokens;
- signing-key deployment consistency across instances.
Confirm whether the endpoint requires:
- a global permission;
- an active-tenant permission;
- tenant ownership;
- a specifically documented global-or-tenant policy.
Global and tenant permissions are intentionally not interchangeable.
Possible causes include expiration, revocation, replay detection, family revocation, account-state change, key rotation, cookie confirmation failure, or an exceeded family/token bound. Replay is a security event and can revoke the family.
Verify exact callback URI, issuer, allowed hosts, nonce/state, PKCE, client credentials, system clock, and provider test-user/audience configuration. Never reuse prior authorization codes or PKCE material.
Keep transactions short, monitor contention, confirm WAL/busy-timeout policy, and move to PostgreSQL when the workload needs multiple sustained writers or horizontal scaling.
The repository intentionally makes ordinary local PostgreSQL execution opt-in, but supported-provider and release evidence requires the protected connection environment. Ensure the expected environment variable is present in the current PowerShell process without printing its value.
Do not rerun unrelated workflows blindly and do not relabel interrupted jobs as successful. Record the exact revision, workflow, job, conclusion, and platform symptom. After service recovery, rerun the applicable workflow and review its retained artifacts.
The current disambiguated display names are ci-windows, operational-readiness-windows, provider-contracts-classify, and test-scope-classify. Required-check configuration must use names actually observed on successful runs, not stale aliases from an earlier manifest.
verify-local is clean-tree and revision-bound. Inspect the complete diff, commit the coherent change, then run verification on the exact clean commit.
SharpAccess · Windows · .NET 10 · PowerShell 7 · Repository · Security · License