Skip to content

README.md

Latest commit

 

History

History
116 lines (81 loc) · 5.59 KB

README.md

File metadata and controls

116 lines (81 loc) · 5.59 KB
Raw

Modtale Mock Database

This is the public MongoDB fixture workflow for local testing and PR previews.

The fixture JSON is not checked into the repo. It is generated by the trusted Refresh Mock Database workflow, validated, uploaded as a GitHub Actions artifact, and loaded into the preview template database used by PR previews.

The refresh workflow runs automatically only for trusted pushes to main or develop that change backend model or repository code:

backend/src/main/java/net/modtale/model/**
backend/src/main/java/net/modtale/repository/**

Before a newly generated artifact is uploaded, the workflow deletes previous modtale-mock-db-json artifacts so GitHub Actions storage does not accumulate old mock DB downloads. Maintainers can still run the workflow manually with workflow_dispatch.

The generated JSON arrays are safe for public download. They may preserve public project fields that are already available through the public API, including author names, project titles, descriptions, categories, public project media URLs, public release metadata, and a DTO-shaped subset of public comments. They never copy real draft, pending, private, or unlisted projects, private project text, real emails, passwords, OAuth tokens, scan results, reports, enforcement actions, admin logs, API keys, private notifications, or detailed analytics.

Import Locally

Download the latest modtale-mock-db-json artifact from the Refresh Mock Database workflow and extract it to:

mock-db/collections/

Install MongoDB Database Tools, then run:

MONGODB_URI=mongodb://localhost:27017 \
MONGODB_DATABASE_NAME=modtale-mock \
bash mock-db/import.sh

Point the backend at the imported database:

export MONGODB_URI=mongodb://localhost:27017
export MONGODB_DATABASE_NAME=modtale-mock
export WARDEN_ENABLED=false

Mock sign-in accounts all use the password password:

super_admin
admin
user
atlas_studio
pixelwright
northstar_collective

Backend Auto-Seeding

For local runs against a Mongo URI that can see the source database, the backend can seed directly on startup. This is the default seeding mode when APP_SEEDING_ENABLED=true: it reads public project data from APP_SEEDING_SOURCE_DB (modtale by default), adds generated synthetic sensitive/admin data, and writes everything into MONGODB_DATABASE_NAME if that target database has no projects yet.

APP_SEEDING_ENABLED=true
APP_SEEDING_SOURCE_DB=modtale
MONGODB_DATABASE_NAME=modtale-local

MONGODB_DATABASE_NAME must not be modtale when pulling from prod. The seeder refuses to run when the target database name equals the source database name.

For fully synthetic fallback data, explicitly use mock mode:

APP_SEEDING_ENABLED=true
APP_SEEDING_MODE=mock
APP_SEEDING_RESET=true

PR previews use the generated sanitized template DB instead:

APP_SEEDING_ENABLED=true
APP_SEEDING_MODE=template
APP_SEEDING_SOURCE_DB=modtale-mock-template
APP_SEEDING_RESET=true

APP_SEEDING_RESET=true clears the mock/template collections before each import. Leave it unset locally if you want database changes to persist between restarts.

PR Preview Isolation

The PR preview workflow is intentionally split from normal branch deploys. It runs from pull_request_target, but it checks out the trusted base branch for workflow/build configuration and only uses PR code as the Docker build context. Configure it with:

GCP_PREVIEW_PROJECT_ID
GCP_PREVIEW_REGION
GCP_PREVIEW_BUILD_SERVICE_ACCOUNT
GCP_PREVIEW_RUNTIME_SERVICE_ACCOUNT
GCP_PREVIEW_MONGODB_SECRET_NAME
GCP_PREVIEW_CREDENTIALS

Both preview service accounts must be scoped to preview-only infrastructure with no production or dev project access. The preview Mongo secret must point at a preview/mock Mongo environment that contains only safe mock/template data.

Refreshing From Real Data

The repository includes a trusted-only refresh path in mock-db/scripts/generate-from-mongo.mjs. It connects to a source MongoDB database, keeps only allow-listed public project shape, synthesizes login accounts and private/admin-only collections, strips private project fields/tokens, preserves only public comment shape with synthetic voter IDs, and writes fresh JSON fixtures.

Sensitive/admin-only collections are never read from the source database. Reports, admin logs, API keys, banned emails, notifications, status incidents, project analytics, and platform analytics are generated synthetically.

This script is intended to run from the Refresh Mock Database GitHub Actions workflow, not from pull requests. Use a source database credential that can read the source database and write the separate template database. If MOCK_TEMPLATE_MONGODB_URI is not set, the workflow uses MOCK_SOURCE_MONGODB_URI for the template load too.

MOCK_SOURCE_MONGODB_URI          # required
MOCK_SOURCE_DATABASE_NAME        # optional, defaults to modtale
MOCK_TEMPLATE_MONGODB_URI        # optional, defaults to MOCK_SOURCE_MONGODB_URI
MOCK_TEMPLATE_DATABASE_NAME      # optional, defaults to modtale-mock-template

MOCK_TEMPLATE_DATABASE_NAME must not equal MOCK_SOURCE_DATABASE_NAME. The workflow refuses to run if both names are the same, because loading the template database drops and replaces mock collections.

After generation, mock-db/scripts/validate-fixtures.mjs checks for forbidden fields and secret-like strings before the workflow uploads the artifact and imports the validated data into the preview template DB.