connectors 0.2.0
Cutting a version in this repository is not cosmetic: [workspace.package] version is the
artifact identity that catalog-build writes into every document's generator field, so this
release rewrites all 67 catalog artifacts, every connectors.lock row, and the wire User-Agent.
They move together, always.
One OAuth implementation, not three
crates/connector-oauth replaces three hand-rolled authorization-code implementations: PKCE with
S256, single-use state with a TTL bound, authorize-URL construction, token-response validation
against a declared policy, and refresh timing with a configurable skew. It owns no transport and
reads no clock — its three callers dial three different ways, and a crate that owned HTTP would
have dragged a client into every consumer.
GitLab, Jira and Slack migrate in one commit each, so a regression bisects to one vendor. Slack
shares the state table and nothing else, on purpose: forcing its xoxp--prefix token judgement and
per-scope charset parser through a shared policy would have changed a request that works today.
Behaviour changes are stated rather than discovered — the pending-state table is now bounded at
1024 in all three, GitLab's refresh response is length-bounded at 4096, and Jira's authorize-URL
parameter order moved (same keys, same encoding, order is not significant). See
docs/stories/S-069-one-oauth-implementation-not-three.md § "Behaviour changes, stated".
A provider can hold a credential it cannot spend
custody_only = true declares a provider that owns a credential and describes no request surface
at all, so a credential whose use belongs to another component can still have an owner, an
address and a lifecycle here. Every key that could describe an outbound request is refused by name,
and the refusal reads the declared TOML key rather than the assembled value — #[serde(default)]
makes base_url = "" indistinguishable from absent, and an author who wrote either believed this
provider would call something.
The catalog publishes the flag rather than merely enforcing it at load time. A consumer must be
able to tell a provider that happens to have no operations from one whose declaration forbids
ever having any; only the second is safe to hand a credential whose use belongs elsewhere. Additive,
so the document schema_version stays 2.
Architecture ruling: platform ADR 0056, which partially supersedes ADR 0014 for custody and says
the boundary moved rather than reinterpreting the old decision. Use is unchanged — a harness
credential is spent by its harness adapter and by nothing else.
Fixed
provider-toml.schema.json referenced #/$defs/authRequirements; the definition is
authRequirement. The document did not compile as a schema, so every rule downstream of that
$ref validated nothing, silently, for as long as it was there.
Full detail in CHANGELOG.md.