From 9adfa91e74de5f4045ce09f2beb33b24bf912b3f Mon Sep 17 00:00:00 2001 From: Albrecht Degering Date: Tue, 21 Jul 2026 16:16:53 +0200 Subject: [PATCH] docs(files): define connector credential retirement --- README.md | 16 ++++++++++++++-- tests/test_manifest_documentation.py | 2 ++ 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index f588e99..7b8cf23 100644 --- a/README.md +++ b/README.md @@ -81,8 +81,14 @@ Profiles can be supplied as JSON through deployment-owned credential references such as `password_env`, `token_env`, or `secret_ref`. Environment references require an exact name in the deployment-wide `GOVOPLAN_CONNECTOR_SECRET_ENV_ALLOWLIST`; API-managed profiles cannot select -process environment variables and use encrypted stored credentials or scoped -secret-provider references instead. +process environment variables and may use only Files-owned encrypted password or +token values. API-created `secret_ref` values fail closed until Files has an +ownership contract that can confirm provider-side deletion. Legacy external +references are treated as non-owned: deleting a profile or credential detaches +and audits the reference but never passes it to an arbitrary secret provider. +Profile and credential deletion immediately clears encrypted values, credential +identities, deployment references, and private metadata in the same transaction +as the non-secret audit record; an audit failure rolls the deletion back. `GET /api/v1/files/connectors/profiles` returns only profiles visible to the current principal (system, tenant, user, group, or accessible campaign scope) and redacts secret values and environment variable names. Use the returned @@ -119,6 +125,12 @@ GovOPlaN pinned HTTP transport and may manage redirects itself, so neither an explicit endpoint nor SDK endpoint discovery is allowed until both peer pinning and redirect revalidation are enforced. +Destructive Files-module retirement applies the same credential lifecycle before +dropping tables. Every remaining Files-owned encrypted connector secret is +scrubbed and audited first, while legacy non-owned external references are +detached and identified as such in the audit record. Retirement does not claim +or attempt provider-side deletion for references Files cannot prove it owns. + Local connector development assets live in `dev/connectors/`. The compose stack boots Nextcloud, Seafile, WebDAV, and SMB endpoints for provider development and manual interoperability testing. diff --git a/tests/test_manifest_documentation.py b/tests/test_manifest_documentation.py index 8a19947..1ce6141 100644 --- a/tests/test_manifest_documentation.py +++ b/tests/test_manifest_documentation.py @@ -13,6 +13,8 @@ class FilesManifestDocumentationTests(unittest.TestCase): self.assertEqual({"user", "admin", "operator"}, set(topic.metadata["perspectives"])) self.assertIn("fails closed", topic.body) self.assertIn("DFS referrals", topic.body) + self.assertIn("immediately scrubs", topic.body) + self.assertTrue(any("non-owned external references" in item for item in topic.metadata["security_invariants"])) self.assertIn("revision", topic.metadata["provenance_fields"]) self.assertIn("/api/v1/files/connectors/profiles", {link.href for link in topic.links})