GovOPlaN/govoplan-files
1
0
Fork 0
Code Issues 13 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(files): define connector credential retirement

Browse Source
This commit is contained in:
Albrecht Degering
2026-07-21 16:16:53 +02:00
parent 65d8ed80b5
commit 9adfa91e74
2 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
README.md
View File

@@ -81,8 +81,14 @@ Profiles can be supplied as JSON through
deployment-owned credential references such as `password_env`, `token_env`, or
`secret_ref`. Environment references require an exact name in the deployment-wide
`GOVOPLAN_CONNECTOR_SECRET_ENV_ALLOWLIST`; API-managed profiles cannot select
process environment variables and use encrypted stored credentials or scoped
secret-provider references instead.
process environment variables and may use only Files-owned encrypted password or
token values. API-created `secret_ref` values fail closed until Files has an
ownership contract that can confirm provider-side deletion. Legacy external
references are treated as non-owned: deleting a profile or credential detaches
and audits the reference but never passes it to an arbitrary secret provider.
Profile and credential deletion immediately clears encrypted values, credential
identities, deployment references, and private metadata in the same transaction
as the non-secret audit record; an audit failure rolls the deletion back.
`GET /api/v1/files/connectors/profiles` returns only profiles visible to the
current principal (system, tenant, user, group, or accessible campaign scope) and
redacts secret values and environment variable names. Use the returned
@@ -119,6 +125,12 @@ GovOPlaN pinned HTTP transport and may manage redirects itself, so neither an
explicit endpoint nor SDK endpoint discovery is allowed until both peer pinning
and redirect revalidation are enforced.
Destructive Files-module retirement applies the same credential lifecycle before
dropping tables. Every remaining Files-owned encrypted connector secret is
scrubbed and audited first, while legacy non-owned external references are
detached and identified as such in the audit record. Retirement does not claim
or attempt provider-side deletion for references Files cannot prove it owns.
Local connector development assets live in `dev/connectors/`. The compose stack
boots Nextcloud, Seafile, WebDAV, and SMB endpoints for provider development and
manual interoperability testing.