Closing a cross-database security gap while shipping the real-time platform that replaces a decade-old ERP, one module at a time.
The Problem
Amor Eterno's core operations — sales, receipts, viewing-room scheduling — ran for over a decade on a VB.NET/GeneXus ERP built around a third-party database (FUNAMOR) the company doesn't own the source for. As the new platform's backend grew, it queried straight across into that legacy database with broad SELECT permissions on multiple tables — the application login could read far more than any single feature required, every schema change on the other side risked breaking the new platform without warning, and there was no auditable interface between the two systems.
The Decision
I documented the problem and the fix as a formal architecture decision record: replace direct cross-database SQL with a governed boundary. Rather than the API reaching into the legacy system's internal tables, database roles were scoped to least privilege, and a controlled interface — views and stored procedures rather than raw table access — became the only path across the boundary. A second ADR defined the specific roles and permissions each identity is allowed to hold.
The Parallel Build
None of this happened in a vacuum with downtime to spare — the legacy VB.NET system kept running production sales, collections, and viewing-room scheduling the entire time. Its real-time replacement (Angular frontend, C# backend, SignalR for live updates, MediaMTX for streaming) was designed and shipped feature by feature, so each capability — monitors, viewing rooms, receipts — moved over only once its modern counterpart was proven.
Why It Matters
This wasn't a UI refresh. It was closing a real security and coupling risk in a live production system while simultaneously building and shipping its replacement — the kind of decision that has to be made deliberately, documented so the reasoning survives past the person who made it, and executed without breaking the business it supports.