NODEDC_DESIGN_GUIDELINE/docs/FOUNDRY_PLATFORM_SETTINGS.md

Platform settings in Module Foundry

Page Library → Настройки Platform is visible only to a Foundry administrator. It currently manages the Cesium Ion master token for the shared Platform Map Gateway.

The UI is deliberately not an editor for Foundry .env, Envoyer, Docker Compose or a deploy artifact. Those paths are root/operator-owned and would expose a provider secret to the wrong persistence boundary.

The request path is:

admin browser → same-origin Foundry API → HMAC-signed private Gateway route → NAS live cache volume/secrets

The browser submits a password field over the existing HTTPS session. Foundry checks the revalidated Launcher/Authentik identity server-side, signs the one request with the internal service secret, and forwards the value without storing it in Foundry runtime data. Before replacing the current private value, Map Gateway verifies the candidate token against the canonical Cesium terrain and imagery assets. Only then does it atomically replace its private token file. The browser receives only configured, audit metadata, and the safe verification state — never a token or endpoint credential.

Foundry groups

• nodedc:module-foundry:admin — can see the Page Library gear and change Platform secrets.
• nodedc:module-foundry:user — may enter Foundry but cannot access Platform settings.
• nodedc:module-foundry:blocked — deny-first; Foundry rejects the session even if another Foundry role was left assigned.
• nodedc:module-foundry:access — legacy member role and currently equivalent to user while existing Launcher grants are migrated.
• nodedc:superadmin and user_root — admin for break-glass/bootstrap continuity.

Raw groups never go back to the browser. Foundry returns only the resolved admin or user role in /api/session/profile; every settings endpoint rechecks admin access independently of the UI.