[wangyinz]

Valid security work

The PR reduces unauthenticated exposure, keeps secrets out of process arguments, and improves authenticated restart handling.

Renewed deployment/security review — draft blocker

This PR remains draft. It changes fresh/default Compose behavior, gives root Mongo credentials to application containers, derives an internal keyfile from those credentials, and leaves the real multi-topology security matrix opt-in/skipped in normal CI. Those are deployment and credential-boundary choices, not merely implementation details.

A security/deployment owner must approve the credential model and fresh/restore migration behavior, and the real four-topology matrix must become a mandatory CI gate before merge. Deterministic fake tests alone are insufficient. The earlier “REVIEW PASS” conclusion is withdrawn.

Related to #794

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.35%. Comparing base (286fa6a) to head (00d7ca1).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #942   +/-   ##
=======================================
  Coverage   74.34%   74.35%           
=======================================
  Files         183      183           
  Lines       36506    36516   +10     
  Branches     2540     2540           
=======================================
+ Hits        27141    27151   +10     
  Misses       8455     8455           
  Partials      910      910           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[wangyinz]

Draft decision required (renewed review)

A deployment/security owner must approve the default Compose credential flow, application access to root credentials, keyfile derivation, and mandatory real-topology test coverage. Keep this PR draft until those security and operations choices are explicitly accepted.

[wangyinz]

Renewed integration review: keep this PR Draft. Rebase after #938 and retain its health-gated dependencies; apply environment credentials only when MSPASS_MONGO_AUTH is enabled; document persisted-volume credential changes; and make the real four-topology security suite a path-filtered CI gate, including an authenticated Spark-connector read/write check. Owner decision: for the shipped loopback-only Compose setup, accept one root credential shared with the frontend, or require separate application credentials.

[wangyinz]

Maintainer decision: preserve the existing research-tool default. Shipped Compose configurations must start MongoDB without authentication and must not require credentials. Authentication may remain only as an explicit opt-in; loopback bindings can stay, and existing default Jupyter behavior must remain compatible. I will rework this PR accordingly and keep it Draft until live default and opt-in validation passes.

[wangyinz]

Updated to preserve the existing research-workstation defaults.

• MongoDB authentication is off by default; no credentials are required.
• Authentication is opt-in with MSPASS_MONGO_AUTH=true plus both root credentials.
• The historical Jupyter password (mspass) and passwordless Spark/MongoDB arguments remain unchanged by default.
• Published Compose ports remain loopback-only.
• The branch is rebased onto current master.

Local validation: 13 focused auth/startup tests, 29 sharding/GeoLab regressions, 9 existing Compose contract tests, Bash syntax, Black 25.1.0, and all four YAML files passed. Docker-backed checks were skipped locally because Docker Desktop WSL integration is unavailable. This PR remains Draft until its remote checks complete.