GovOPlaN/govoplan-files
1
0
Fork 0
Code Issues 13 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(files): define connector credential retirement

Browse Source
This commit is contained in:
Albrecht Degering
2026-07-21 16:16:53 +02:00
parent 65d8ed80b5
commit 9adfa91e74
2 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
README.md
View File

@@ -81,8 +81,14 @@ Profiles can be supplied as JSON through
deployment-owned credential references such as `password_env`, `token_env`, or deployment-owned credential references such as `password_env`, `token_env`, or
`secret_ref`. Environment references require an exact name in the deployment-wide `secret_ref`. Environment references require an exact name in the deployment-wide
`GOVOPLAN_CONNECTOR_SECRET_ENV_ALLOWLIST`; API-managed profiles cannot select `GOVOPLAN_CONNECTOR_SECRET_ENV_ALLOWLIST`; API-managed profiles cannot select
process environment variables and use encrypted stored credentials or scoped process environment variables and may use only Files-owned encrypted password or
secret-provider references instead. token values. API-created `secret_ref` values fail closed until Files has an
ownership contract that can confirm provider-side deletion. Legacy external
references are treated as non-owned: deleting a profile or credential detaches
and audits the reference but never passes it to an arbitrary secret provider.
Profile and credential deletion immediately clears encrypted values, credential
identities, deployment references, and private metadata in the same transaction
as the non-secret audit record; an audit failure rolls the deletion back.
`GET /api/v1/files/connectors/profiles` returns only profiles visible to the `GET /api/v1/files/connectors/profiles` returns only profiles visible to the
current principal (system, tenant, user, group, or accessible campaign scope) and current principal (system, tenant, user, group, or accessible campaign scope) and
redacts secret values and environment variable names. Use the returned redacts secret values and environment variable names. Use the returned
@@ -119,6 +125,12 @@ GovOPlaN pinned HTTP transport and may manage redirects itself, so neither an
explicit endpoint nor SDK endpoint discovery is allowed until both peer pinning explicit endpoint nor SDK endpoint discovery is allowed until both peer pinning
and redirect revalidation are enforced. and redirect revalidation are enforced.
Destructive Files-module retirement applies the same credential lifecycle before
dropping tables. Every remaining Files-owned encrypted connector secret is
scrubbed and audited first, while legacy non-owned external references are
detached and identified as such in the audit record. Retirement does not claim
or attempt provider-side deletion for references Files cannot prove it owns.
Local connector development assets live in `dev/connectors/`. The compose stack Local connector development assets live in `dev/connectors/`. The compose stack
boots Nextcloud, Seafile, WebDAV, and SMB endpoints for provider development and boots Nextcloud, Seafile, WebDAV, and SMB endpoints for provider development and
manual interoperability testing. manual interoperability testing.

2
tests/test_manifest_documentation.py
View File

@@ -13,6 +13,8 @@ class FilesManifestDocumentationTests(unittest.TestCase):
self.assertEqual({"user", "admin", "operator"}, set(topic.metadata["perspectives"])) self.assertEqual({"user", "admin", "operator"}, set(topic.metadata["perspectives"]))
self.assertIn("fails closed", topic.body) self.assertIn("fails closed", topic.body)
self.assertIn("DFS referrals", topic.body) self.assertIn("DFS referrals", topic.body)
self.assertIn("immediately scrubs", topic.body)
self.assertTrue(any("non-owned external references" in item for item in topic.metadata["security_invariants"]))
self.assertIn("revision", topic.metadata["provenance_fields"]) self.assertIn("revision", topic.metadata["provenance_fields"])
self.assertIn("/api/v1/files/connectors/profiles", {link.href for link in topic.links}) self.assertIn("/api/v1/files/connectors/profiles", {link.href for link in topic.links})