MGCLatticeDbAccessService
Custom service that vends just-in-time (JIT) AxDB db_owner access to integration administrators. A successful requestAccess call validates the caller and the supplied public IPv4 address, revokes any prior active grant for the caller (one active grant per administrator), records the audit row, provisions a new contained database user added to db_owner, opens a database firewall rule for the IP, stores the password encrypted on the audit row, and returns the generated password exactly once on the live response. revokeAccess revokes the caller's own active grant. A revoke that fails never marks a grant Revoked: the grant stays Active with its expiry moved to now, so MGCLatticeDbAccessExpiryBatch retries the revoke on its next run, and the failure is recorded without sensitive detail. Because the audit row is written before any SQL runs, whatever a failed or interrupted provisioning leaves behind is on a row the expiry sweep cleans up. SECURITY: this operation grants full AxDB db_owner. It is privilege-gated (MGCLatticeDbAccessAdminPrivilege) AND re-checks the caller's menu access in code (defense in depth). The password is stored only encrypted by the platform encryption service and is never written to the infolog or any log.
Methods
new
Initializes a new instance of the MGCLatticeDbAccessService class.
- Visibility:
public - Returns:
void
No parameters.
construct
Creates a new instance of the MGCLatticeDbAccessService class.
- Visibility:
public - Returns:
MGCLatticeDbAccessServiceA new MGCLatticeDbAccessService instance.
No parameters.
parmProvisioner
Gets or sets the SQL worker that provisions and revokes grants. When none is set, the default MGCLatticeDbAccessProvisioner is used; tests set a double that runs no SQL.
- Visibility:
public - Returns:
MGCLatticeDbAccessProvisionerThe provisioner that is set, or null when the default is used.
| Name | Type | Optional | Description |
|---|---|---|---|
_provisioner | MGCLatticeDbAccessProvisioner | Yes | The provisioner to use. |
currentProvisioner
Returns the provisioner set through parmProvisioner, creating the default one on first use.
- Visibility:
protected - Returns:
MGCLatticeDbAccessProvisionerThe provisioner that executes the grant SQL.
No parameters.
requestAccess
Provisions a just-in-time AxDB db_owner grant for the calling administrator and the supplied public IPv4 address. Re-checks authorization in code (defense in depth, even though the operation is privilege-gated) and then delegates to provisionAccessCore - the single shared provisioning code path used by BOTH this service operation and the maintenance form, so the logic is never duplicated. The generated password is returned exactly once on the live response.
- Visibility:
public - Returns:
MGCLatticeDbAccessResponseContractAn MGCLatticeDbAccessResponseContract; the password is populated only on this live response.
| Name | Type | Optional | Description |
|---|---|---|---|
_request | MGCLatticeDbAccessRequestContract | No | The request carrying the IpAddress to allowlist and optional DurationHours. |
provisionAccessCore
Shared core that provisions a JIT db_owner grant. This is the SINGLE provisioning code path used by both the requestAccess service operation and the maintenance form's Request Access action, so the provisioning logic is never duplicated. Validates the IP, makes sure the expiry sweep is scheduled (the first grant schedules it), revokes any prior active grant for the caller (one active grant per administrator; a prior grant that cannot be revoked now is deferred to the expiry sweep and does not block the new one), writes the audit row, provisions a new db_owner user and firewall rule, then stores the password ENCRYPTED AT REST via MGCLatticeDbAccessGrant.setPassword. The cleartext is never logged and is returned only once on the live response contract. A failure after the audit row was written is rolled back by bestEffortRollback. Callers MUST perform their own authorization check before calling this method.
- Visibility:
public - Returns:
MGCLatticeDbAccessResponseContractAn MGCLatticeDbAccessResponseContract; the password is populated only on this live response.
| Name | Type | Optional | Description |
|---|---|---|---|
_request | MGCLatticeDbAccessRequestContract | No | The request carrying the IpAddress to allowlist and optional DurationHours. |
revokeAccess
Revokes the calling administrator's own active JIT grant, if any: drops the database user and firewall rule and marks the audit row Revoked. A grant whose revoke fails stays Active with its expiry moved to now, so the expiry sweep retries it. Idempotent and safe to call when no grant exists.
- Visibility:
public - Returns:
MGCLatticeDbAccessResponseContractAn MGCLatticeDbAccessResponseContract indicating the outcome (never carries a password).
| Name | Type | Optional | Description |
|---|---|---|---|
_request | MGCLatticeDbAccessRevokeRequestContract | No | The request; its CorrelationId is echoed. |
revokeGrant
Revokes a specific, named JIT grant selected in the maintenance form: drops the database user and firewall rule and marks the audit row Revoked. Re-checks authorization in code (defense in depth) before doing anything. Any holder of the administrator role may revoke any grant, including one another user requested (cutting off someone's access is a legitimate administrator action); only Show password is limited to the grant's own requester (showPassword). A grant whose revoke fails stays Active with its expiry moved to now, so the expiry sweep retries it. Idempotent: a missing grant returns Success=true.
- Visibility:
public - Returns:
MGCLatticeDbAccessResponseContractAn MGCLatticeDbAccessResponseContract indicating the outcome (never carries a password).
| Name | Type | Optional | Description |
|---|---|---|---|
_username | str | No | The provisioned database user name identifying the grant to revoke. |
showPassword
Decrypts and returns the stored password for a specific ACTIVE grant so the administrator who requested it can re-retrieve the credential within its lifetime (the maintenance form's Show Password action). Re-checks authorization in code (defense in depth) before decrypting, and refuses (AccessDenied) a grant requested by another user: holding the administrator role does not reveal someone else's password. The cleartext is returned to the caller only; this method never writes it to the infolog or any log. Returns Success=false with a non-sensitive message when the grant is missing, not active, past its expiry (for example waiting for the expiry sweep to revoke it), or has no stored password.
- Visibility:
public - Returns:
MGCLatticeDbAccessResponseContractAn MGCLatticeDbAccessResponseContract whose Password member carries the decrypted cleartext on success (populated only on this live response); a failure response carries no credentials.
| Name | Type | Optional | Description |
|---|---|---|---|
_username | str | No | The provisioned database user name identifying the grant. |