58 lines
1.2 KiB
Markdown
58 lines
1.2 KiB
Markdown
# NEXPA SourceHub 3.8 Architecture
|
|
|
|
## Request path
|
|
Internet / Office Network
|
|
→ HTTPS Reverse Proxy
|
|
→ SourceHub Login Gate
|
|
→ NEXPA Core OIDC
|
|
→ Role Binding
|
|
→ FastAPI
|
|
|
|
## Data
|
|
FastAPI
|
|
→ SQLAlchemy → PostgreSQL
|
|
→ Upload Pipeline → SHA-256 → ClamAV → MinIO
|
|
→ Gitea API
|
|
→ Audit Log
|
|
|
|
## Download
|
|
Authenticated user
|
|
→ `/api/revisions/{id}/download-link`
|
|
→ 5-minute signed URL
|
|
→ `/download/{id}?token=...`
|
|
→ MinIO/Local object
|
|
|
|
## Revision contract
|
|
R1 immutable
|
|
R2 append
|
|
R3 append
|
|
...
|
|
Revision addition resets approval flow but never overwrites prior files.
|
|
|
|
## Approval flow
|
|
UPLOADED
|
|
→ RECEIVED
|
|
→ QA_REVIEW
|
|
→ CONTENT_REVIEW
|
|
→ DEPLOY_REVIEW
|
|
→ APPROVED
|
|
|
|
## Deployment executor
|
|
APPROVED/Gate-complete item
|
|
→ deploy role only
|
|
→ server-side allowlisted webhook target
|
|
→ HMAC signature
|
|
→ deployment run + audit log
|
|
|
|
No arbitrary user-supplied shell command is executed.
|
|
|
|
## Security boundaries
|
|
- Secrets: environment only
|
|
- UI inaccessible before OIDC session
|
|
- Static bypass removed
|
|
- CSRF on mutating requests in OIDC mode
|
|
- Trusted Host list
|
|
- Signed expiring downloads
|
|
- Malware scan before object storage
|
|
- Deployment Gate enforcement
|