Editing Documentation (section)

=== Data Security ===

==== Access Control ====
* '''Database Roles and Privileges:'''
** Row-level or schema-level security can be configured if certain data must be restricted to specific roles.  
* '''Application-Level Permissions:''' 
** [https://unitapedia.univ-unita.eu/strapi/ Strapi] can enforce role-based access, ensuring only UNITA Office roles can submit or update data.  
** MediaWiki’s namespaces (e.g., <code>DataSrc</code>, <code>Doc</code>) can be locked down to specific groups or user roles for editing, while read access might be more widely available.

==== Authentication/Authorization ====
* '''MediaWiki''': Users log in to access pages or to perform data-related actions. In a production environment, Single Sign-On (SSO) or OAuth could be integrated to streamline user management.  
* '''Strapi''': Form submissions require an authenticated user with the correct permissions.  
* '''Apache HOP Carte''': Administrator credentials are required to deploy and schedule transformations.

==== Datawarehouse Compartmentalization ====
The UNITApedia Datawarehouse is architected to clearly separate different types of data through the use of multiple databases and schemas. Each database within the data warehouse serves a distinct purpose, and within each database, data is organized into logical schemas containing related tables. For example:
* '''Strapi Database:'''  
** Contains raw input data from [https://unitapedia.univ-unita.eu/strapi/ Strapi] forms.  
** Schemas in this database hold tables with initial, untransformed indicator entries.  
* '''Datamart Database:''' 
** Stores transformed and processed data ready for consumption by MediaWiki.  
** Within the datamart, tables are organized under one or more schemas (commonly the public schema) such as public.t125, public.t126, etc.  
* '''Additional Databases:''' 
** The unita-data database contains metadata and configuration details used by MediaWiki.  

This multi-database, multi-schema design enables:  
* '''Isolation:''' Raw data is kept separate from processed data, reducing the risk of accidental overwrites and ensuring data integrity.  
* '''Security:''' Different access controls can be applied at both the database and schema levels, so only authorized roles can access or modify sensitive data.  
* '''Maintainability:''' Logical separation simplifies performance tuning, backup strategies, and data governance by grouping related tables together.