Documentation
¶
Overview ¶
Package connectionapi serves the user-facing /connect/{provider} and /connections routes that orchestrate the upstream-Broker connect dance.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ConsentURL ¶
ConsentURL builds the absolute URL a client should redirect to in order to start (or re-authorize) a Broker upstream-connection. The shape after
is `<base>/connect/<providerSlug>?resource=<resourceSlug>&return_url=<base>/connections`.
providerSlug names the BrokerProvider (the AS-side identifier for the upstream OAuth client); resourceSlug names the originating Broker resource for forensic logging on the connect handler. When resourceSlug is empty (a defensive fallback — 's dispatchBroker always populates it), the `?resource=` parameter is omitted.
This helper is the single source of truth for the public consent URL shape. Any change to the registered paths is caught by a single grep.
Returns "" when base is empty. Callers should treat that as "no consent URL available" — the wire response still uses error code consent_required but omits the consent_url field (the DTO uses omitempty).
func ReconsentURL ¶
ReconsentURL builds the URL a client should redirect to in order to re-consent at the AS for a Mint resource. Used for bound-B (agent-attestation row missing) and bound-C (agent-attestation scope insufficient) failures, where the remediation is the user re-running /authorize at the AS — NOT a re-connect at an upstream provider.
Shape: `<base>/authorize?resource=<resourceSlug>&scope=<scope>`. When `scope` is empty the parameter is omitted. Both components are URL- escaped; an empty resourceSlug yields the same omission as ConsentURL's empty-providerSlug case (i.e. the path becomes `/authorize?` with no resource hint — the caller is expected to populate resourceSlug for any error that originated from dispatchBroker / dispatchMint).
Returns "" when base is empty. Callers should treat that as "no consent URL available" — the wire response still uses error code consent_required but omits the consent_url field (the DTO uses omitempty).
func RegisterRoutes ¶
func RegisterRoutes(mux *http.ServeMux, deps Deps, sessMW *shared.SessionMiddleware, obs *observability.Provider)
RegisterRoutes wires the user-facing /connect + /connections routes. Token vending flows through POST /oauth/token with resource=<slug>; this package only serves the connect/disconnect + connections-listing surface.
when deps.Connect is nil (operator opted out — boot's feature self-check would have failed if the config were merely partial), the routes are still registered but return a typed feature_disabled error. The pre- behavior was to leave the routes unbound, which produced a 404 with no diagnostic — the canonical empty-consent_url failure mode.
Types ¶
type CompleteConnectResult ¶
type CompleteConnectResult = input.CompleteConnectResult
CompleteConnectResult bundles the metadata the callback handler needs to render the post-connect redirect.
type ConnectProvider ¶
type ConnectProvider interface {
StartConnect(ctx context.Context, userID, providerSlug, resourceSlug, returnURL string) (string, error)
CompleteConnect(ctx context.Context, userID, stateToken, code string) (CompleteConnectResult, error)
Disconnect(ctx context.Context, userID, providerSlug string) error
ListConnections(ctx context.Context, userID string) ([]ConnectionMeta, error)
}
ConnectProvider is the service-layer surface the connection handlers depend on. : the path-parameter is the BrokerProvider slug, not the resource slug; resourceSlug is an optional originating-resource hint that gates the per-resource policy.connect.allowed_return_urls lookup.
type ConnectionMeta ¶
type ConnectionMeta = input.ConnectionMeta
ConnectionMeta is re-exported from internal/ports/input so handlers serialize the canonical input-layer DTO without taking a direct dependency on internal/services.
type Deps ¶
type Deps struct {
Connect ConnectProvider
}
Deps holds the dependencies for the public connection handlers.
Source Files