mirror of
https://github.com/Such-Software/smirk-backend-core.git
synced 2026-10-17 15:31:38 +02:00
jwinterm
00968a9c05
Stage 1 of the operator-editable config layer (additive; no behavior change yet): - migration operator_settings: one MAC(ADMIN_KEY_INTEGRITY_SECRET) JSONB row per section, FK to admin_keys, audited on write. Missing section = env-only. - OperatorSettingRow model. - SettingsOverlay + section overlays (landing/retention/restore) with secrets EXCLUDED BY CONSTRUCTION; Config::apply_overlay merges onto the env-derived Config then re-runs the SAME Config::validate boot uses (a bad edit yields the identical error, nothing persists, the instance cannot be bricked). - runtime_class() single source of truth (RuntimeSafe hot-swap vs RestartRequired). - operator_settings storage: canonical-JSON MAC (stable across JSONB key reorder), load_settings_overlay (fail-closed per section -> env fallback), put_setting_audited (upsert + admin_audit append in one tx). - sqlx json feature. cargo check clean; 4 new unit tests pass. Next stages: ArcSwap AppState + ~59 read-site migration, GET/PUT /admin/config (+ restart_apply_mode), remaining sections.