OrgTJWater/TJWaterServerBinary
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(metadata): drop geoserver config refs

Browse Source
This commit is contained in:
jiang
2026-06-13 14:57:33 +08:00
parent 80ca985c28
commit 4c0a4b29e9
2 changed files with 10 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AUTHENTICATION_AND_USER_MANAGEMENT.md
+8 -13
View File
@@ -51,22 +51,18 @@ Project configuration:
- `PUT /api/v1/admin/projects/{project_id}/databases` - `PUT /api/v1/admin/projects/{project_id}/databases`
- `DELETE /api/v1/admin/projects/{project_id}/databases/{db_role}` - `DELETE /api/v1/admin/projects/{project_id}/databases/{db_role}`
- `POST /api/v1/admin/projects/{project_id}/databases/{db_role}/health` - `POST /api/v1/admin/projects/{project_id}/databases/{db_role}/health`
- `GET /api/v1/admin/projects/{project_id}/geoserver`
- `PUT /api/v1/admin/projects/{project_id}/geoserver`
## Secret Handling ## Secret Handling
Admins submit plaintext DSNs and GeoServer passwords only through HTTPS admin Admins submit plaintext DSNs only through HTTPS admin APIs. Operators should not
APIs. Operators should not write encrypted columns manually. write encrypted columns manually.
- `project_databases.dsn_encrypted` is encrypted with `DATABASE_ENCRYPTION_KEY`. - `project_databases.dsn_encrypted` is encrypted with `DATABASE_ENCRYPTION_KEY`.
- `project_geoserver_configs.gs_admin_password_encrypted` is encrypted with - Admin responses return only `has_dsn`.
`ENCRYPTION_KEY`.
- Admin responses return only `has_dsn` or `has_password`.
- Audit logs record whether a secret was updated, but never store plaintext DSNs - Audit logs record whether a secret was updated, but never store plaintext DSNs
or passwords. or other secrets.
Generate both keys with: Generate the database encryption key with:
```bash ```bash
python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())" python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
@@ -83,13 +79,12 @@ Apply metadata patches in order:
2. `resources/sql/005_metadata_project_configuration.sql` 2. `resources/sql/005_metadata_project_configuration.sql`
`004` creates Keycloak-backed metadata users and project memberships. `005` `004` creates Keycloak-backed metadata users and project memberships. `005`
creates project, project database routing, and GeoServer configuration tables creates project and project database routing tables with uniqueness, role/type,
with uniqueness, role/type, and pool-size constraints. and pool-size constraints.
## Frontend System Management ## Frontend System Management
`/system-admin` is shown only after `GET /api/v1/admin/me` confirms metadata `/system-admin` is shown only after `GET /api/v1/admin/me` confirms metadata
admin access. The page lets admins maintain metadata users, project members, admin access. The page lets admins maintain metadata users, project members,
projects, project database routing for `biz_data` and `iot_data`, connection projects, project database routing for `biz_data` and `iot_data`, connection
health checks, and GeoServer config. This replaces direct SQL editing for normal health checks. This replaces direct SQL editing for normal project onboarding.
project onboarding.
app/api/v1/endpoints/admin_metadata.py
+2 -2
View File
@@ -270,7 +270,7 @@ async def create_admin_project(
except IntegrityError as exc: except IntegrityError as exc:
raise HTTPException( raise HTTPException(
status_code=status.HTTP_409_CONFLICT, status_code=status.HTTP_409_CONFLICT,
detail="Project code or GeoServer workspace conflicts with an existing project", detail="Project code or workspace conflicts with an existing project",
) from exc ) from exc
except SQLAlchemyError as exc: except SQLAlchemyError as exc:
raise HTTPException( raise HTTPException(
@@ -307,7 +307,7 @@ async def update_admin_project(
except IntegrityError as exc: except IntegrityError as exc:
raise HTTPException( raise HTTPException(
status_code=status.HTTP_409_CONFLICT, status_code=status.HTTP_409_CONFLICT,
detail="Project code or GeoServer workspace conflicts with an existing project", detail="Project code or workspace conflicts with an existing project",
) from exc ) from exc
except SQLAlchemyError as exc: except SQLAlchemyError as exc:
raise HTTPException( raise HTTPException(