docs(design): add OKF user story catalog

2026-08-01 14:49:37 -04:00
parent 2657399628
commit fa5346458a
21 changed files with 777 additions and 1 deletions
@@ -0,0 +1,43 @@
+---
+type: User Story
+title: Deploy and operate the platform securely
+description: Operators have repeatable builds, migrations, credential provisioning, configuration, and security checks.
+tags: [operations, security, database, deployment]
+timestamp: 2026-08-01T18:43:58Z
+story_id: US-015
+status: verified
+---
+
+# User Story
+
+As a platform operator, I want reproducible deployment and security controls, so that the portal, bot, database, and proxy can be operated safely.
+
+# Acceptance Criteria
+
+- [x] The repository is an npm TypeScript workspace with separate web, bot, contract, database, network, and Minecraft modules.
+- [x] PostgreSQL is available through Docker Compose for local use.
+- [x] Drizzle changes use generated, versioned migrations rather than schema push.
+- [x] Velocity credentials can be provisioned or rotated with a one-time-displayed token stored only as a hash.
+- [x] The Velocity Gradle wrapper produces a tested shaded JAR.
+- [x] Environment examples document database, Keycloak, Discord, trusted proxy, and ProxyCheck settings without secrets.
+- [x] The web application sets CSP, framing, MIME, referrer, and permissions headers.
+- [x] npm dependency audit and Semgrep security review complete without findings at the last verified change.
+- [x] Architecture, Keycloak, API error, security, bot, and Velocity operating documentation is available.
+
+# Implementation
+
+- [`package.json`](../package.json)
+- [`compose.yml`](../compose.yml)
+- [`packages/database/drizzle`](../packages/database/drizzle)
+- [`packages/database/scripts/create-plugin-credential.ts`](../packages/database/scripts/create-plugin-credential.ts)
+- [`plugins/velocity/build.gradle.kts`](../plugins/velocity/build.gradle.kts)
+- [`apps/web/next.config.ts`](../apps/web/next.config.ts)
+
+# Validation
+
+Use `npm test`, `npm run typecheck`, `npm run lint`, `npm run build`, `npm run velocity:build`, `npm audit`, and `npm run design:validate`.
+
+# Related Stories
+
+- [Administrator SSO](us-011-admin-sso.md)
+- [Standardize API errors](us-014-problem-details.md)