# Platform settings in Module Foundry

`Page Library → Настройки Platform` is visible only to a Foundry administrator. It currently manages the Cesium Ion master token for the shared Platform Map Gateway.

The UI is deliberately not an editor for Foundry `.env`, Envoyer, Docker Compose or a deploy artifact. Those paths are root/operator-owned and would expose a provider secret to the wrong persistence boundary.

The request path is:

```text
admin browser → same-origin Foundry API → HMAC-signed private Gateway route → NAS live cache volume/secrets
```

The browser submits a password field over the existing HTTPS session. Foundry checks the revalidated Launcher/Authentik identity server-side, signs the one request with the internal service secret, and forwards the value without storing it in Foundry runtime data. Before replacing the current private value, Map Gateway verifies the candidate token against the canonical Cesium terrain and imagery assets. Only then does it atomically replace its private token file. The browser receives only `configured`, audit metadata, and the safe verification state — never a token or endpoint credential.

## Foundry groups

- `nodedc:module-foundry:admin` — can see the Page Library gear and change Platform secrets.
- `nodedc:module-foundry:user` — may enter Foundry but cannot access Platform settings.
- `nodedc:module-foundry:blocked` — deny-first; Foundry rejects the session even if another Foundry role was left assigned.
- `nodedc:module-foundry:access` — legacy member role and currently equivalent to `user` while existing Launcher grants are migrated.
- `nodedc:superadmin` and `user_root` — admin for break-glass/bootstrap continuity.

Raw groups never go back to the browser. Foundry returns only the resolved `admin` or `user` role in `/api/session/profile`; every settings endpoint rechecks admin access independently of the UI.