pal-e-docs

Plan: minio-mobile

plan-minio-mobile Plan

plan deprecated
Project

Plan: minio-mobile

Vision

A mobile-first, multi-tenant asset portal for MinIO. Stakeholders log in via Keycloak and see only their project's assets. Admins see everything. Replaces the unusable stock MinIO Console on mobile devices.

Projects & Repos Touched

Project/Repo Platform Role in this plan
forgejo_admin/minio-playground Forgejo Prototype with auth flow, role-based views
forgejo_admin/minio-api Forgejo FastAPI service with Keycloak auth + tenant scoping (to be created)
forgejo_admin/minio-app Forgejo SvelteKit production app (to be created)
forgejo_admin/minio-sdk Forgejo Shared S3 SDK (owned by pal-e-platform, consumed here)

Context

Born from pal-e-platform Phase 24-27 (MinIO Mobile Interface). Phase 24 (SDK) and Phase 26 (Playground v1) completed on pal-e-platform. The scope expanded when we realized this needs multi-tenant auth — stakeholders should be able to log in and see only their project's assets. That makes this a product, not a platform utility.
What's already done:
  • minio-sdk v0.1.0 — custom Signature V4 signing, 62 tests, published to Forgejo PyPI (pal-e-platform Phase 24)
  • minio-playground v1 — 5 HTML pages, mobile-first CSS, mock data, no auth flow (pal-e-platform Phase 26)

Previous Plan

plan-pal-e-platform — Phases 24-27. Phases 25 and 27 superseded by this plan (deferred on platform, replaced here with auth-aware equivalents).

Depends On

phase-pal-e-platform-24-minio-sdk — SDK must be published (COMPLETED).

Decisions Made

Decision Rationale
Separate project from pal-e-platform Multi-tenant auth + stakeholder access = product, not infrastructure utility. Don't bloat the platform plan.
Keycloak auth (not open/tailnet-only) Stakeholders need login. Keycloak groups map to MinIO bucket prefixes for tenant scoping.
Playground starts from auth flow Auth is core UX, not a bolt-on. Playground must prototype signin → role-based views before SvelteKit (westside pattern).
No third-party S3 SDKs Own the stack. Custom Signature V4 signing. Full HTTP control. (Inherited from Phase 24.)
Presigned URLs for file transfer API generates presigned URLs, browser talks directly to MinIO for upload/download. No file byte proxying.

Phases

See child phase notes: list_notes(parent_slug="plan-minio-mobile")

Key Files

Phase File Repo Change
1 signin.html, app.js, style.css minio-playground Auth flow + role-based views
2 routes/*.py, auth.py minio-api FastAPI + Keycloak middleware
3 src/routes/** minio-app SvelteKit promotion

Verification

  • [ ] Playground auth flow approved on phone (390px)
  • [ ] API serves all SDK operations with Keycloak token validation
  • [ ] Stakeholder sees only their prefix, admin sees everything
  • [ ] SvelteKit app deployed to k3s with real Keycloak auth

Epilogue

QA nits and discovered scope tracked here.
  • plan-pal-e-platform — parent plan (Phases 24, 26 completed there)
  • phase-pal-e-platform-24-minio-sdk — SDK (completed, shared dependency)
  • phase-pal-e-platform-26-minio-playground — Playground v1 (completed)
  • project-frontend-playground — playground CSS paradigm
  • convention-frontend-css — CSS conventions