GovOPlaN/govoplan-addresses
1
0
Fork 0
Code Issues 4 Pull Requests Actions Packages Projects Releases Wiki Activity

docs: define CardDAV credential deletion

Browse Source
This commit is contained in:
Albrecht Degering
2026-07-21 15:54:47 +02:00
parent d005040a8e
commit 75c9ece709
2 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
README.md
View File

@@ -43,6 +43,13 @@ inspection UI are implemented. The conflict review UI compares stored local and
remote field payloads, can apply a stored remote vCard payload, and supports remote field payloads, can apply a stored remote vCard payload, and supports
manual per-field local/remote merge choices. manual per-field local/remote merge choices.
API-managed CardDAV credentials are encrypted inside the source record. Source
deletion physically removes that credential material and records a non-secret
audit event in the same database transaction; destructive module retirement
audits every remaining credential before the owning tables are dropped. Legacy
external references are detached but are never sent to a secret provider for
deletion because Addresses cannot prove that it owns them.
## Boundary ## Boundary
`govoplan-addresses` owns: `govoplan-addresses` owns:

7
docs/ADDRESS_MODULE_ARCHITECTURE.md
View File

@@ -148,7 +148,12 @@ a conflict instead of silently overwriting remote data. The first conflict
review UI compares stored local and remote field payloads and can apply a review UI compares stored local and remote field payloads and can apply a
stored remote vCard payload or a manual per-field local/remote merge payload. stored remote vCard payload or a manual per-field local/remote merge payload.
Source disconnect/delete removes the source binding and related sync records Source disconnect/delete removes the source binding and related sync records
while keeping local contacts. while keeping local contacts. Because API-managed CardDAV credentials are
encrypted in the source row, the same transaction physically removes their
ciphertext and emits non-secret credential-deletion audit evidence. Destructive
module retirement audits all remaining owned credential material before table
removal. An unowned legacy reference is detached rather than passed to an
external secret provider.
## Connector Direction ## Connector Direction