3.3 KiB
3.3 KiB
type, title, description, tags, timestamp, story_id, status
| type | title | description | tags | timestamp | story_id | status | ||||
|---|---|---|---|---|---|---|---|---|---|---|
| User Story | Deploy and operate the platform securely | Operators have repeatable builds, migrations, credential provisioning, configuration, and security checks. |
|
2026-08-08T15:05:48Z | US-015 | verified |
User Story
As a platform operator, I want reproducible deployment and security controls, so that the portal, bot, database, and proxy can be operated safely.
Acceptance Criteria
- The repository is an npm TypeScript workspace with separate web, bot, contract, database, network, and Minecraft modules.
- PostgreSQL is available through Docker Compose for local use.
- Drizzle changes use generated, versioned migrations rather than schema push.
- Velocity credentials can be provisioned or rotated with a one-time-displayed token stored only as a hash.
- The Velocity Gradle wrapper produces a tested shaded JAR.
- Environment examples document database, Keycloak, Discord, trusted proxy, and ProxyCheck settings without secrets.
- The web application sets CSP, framing, MIME, referrer, and permissions headers.
- Database-backed user and administrator pages render as dynamic React Server Components with server-side data access.
- Core pages provide keyboard focus indication, a skip link, labelled controls, table semantics, live status messaging, sufficient text contrast, and reduced-motion support.
- The web runtime provides a dependency-free, uncached health endpoint for orchestration probes that reports readiness and the immutable
APP_VERSION, falling back todevelopmentwhen no build version is supplied. - Web and Discord bot runtimes emit structured Pino logs with credential-field redaction and safe operational context.
- npm dependency audit and Semgrep security review complete without findings at the last verified change.
- Architecture, Keycloak, API error, security, bot, and Velocity operating documentation is available.
Implementation
package.jsoncompose.ymlpackages/database/drizzlepackages/database/scripts/create-plugin-credential.tsplugins/velocity/build.gradle.ktsapps/web/next.config.tsapps/web/src/app/healthz/route.tsDockerfilepackages/logging/src/index.tsdocs/accessibility.md
Validation
Use npm test, npm run typecheck, npm run lint, npm run build, npm run velocity:build, npm audit, and npm run design:validate. Structured logging redaction is covered by packages/logging/test/logger.test.ts. Health endpoint tests verify the supplied immutable build version, the development fallback, readiness status, and uncached response; full workspace tests, type checks, lint, OKF validation, and a production web build passed on 2026-08-08.