2.2 KiB
2.2 KiB
type, title, description, tags, timestamp, story_id, status
| type | title | description | tags | timestamp | story_id | status | ||||
|---|---|---|---|---|---|---|---|---|---|---|
| User Story | Deploy and operate the platform securely | Operators have repeatable builds, migrations, credential provisioning, configuration, and security checks. |
|
2026-08-01T19:46:09Z | US-015 | verified |
User Story
As a platform operator, I want reproducible deployment and security controls, so that the portal, bot, database, and proxy can be operated safely.
Acceptance Criteria
- The repository is an npm TypeScript workspace with separate web, bot, contract, database, network, and Minecraft modules.
- PostgreSQL is available through Docker Compose for local use.
- Drizzle changes use generated, versioned migrations rather than schema push.
- Velocity credentials can be provisioned or rotated with a one-time-displayed token stored only as a hash.
- The Velocity Gradle wrapper produces a tested shaded JAR.
- Environment examples document database, Keycloak, Discord, trusted proxy, and ProxyCheck settings without secrets.
- The web application sets CSP, framing, MIME, referrer, and permissions headers.
- The web runtime provides a dependency-free health endpoint for orchestration probes.
- npm dependency audit and Semgrep security review complete without findings at the last verified change.
- Architecture, Keycloak, API error, security, bot, and Velocity operating documentation is available.
Implementation
package.jsoncompose.ymlpackages/database/drizzlepackages/database/scripts/create-plugin-credential.tsplugins/velocity/build.gradle.ktsapps/web/next.config.ts
Validation
Use npm test, npm run typecheck, npm run lint, npm run build, npm run velocity:build, npm audit, and npm run design:validate.