EPIC P — Provider Connections

[haydercyber]

Tracking issue for the Provider Connections EPIC. provider_connections becomes a real operator/admin feature: full CRUD over the BRD §17 entity, project-binding model, DB-backed discover scheduling that retires SB_DISCOVER_TARGETS_JSON, and an admin UI page.

Design was closed §1–§6 with sign-off before any code. Key locked decisions:

• Project binding via dedicated join table project_provider_connections (not a column on provider_connections, not a reuse of project_secrets). environment_id nullable for project-wide bindings; two partial unique indexes per Postgres NULL semantics.
• cluster_name on provider_connections as TEXT; discover_enabled=true requires cluster_name IS NOT NULL at the CHECK + service layer.
• Dropdown filter is bound-to-project/env, not visible-to-project. Sanitized projection (id, name, type only).
• integration.edit for admin CRUD, scoped secret.request for the developer dropdown — same URL, branched in handler.
• Stable error envelope {error_code, message} matching EPIC N.
• Sanitizer lives in api/pkg/sanitize (exported package) so both api and worker can use it without crossing the internal/ fence.
• MarkDiscoverFinished accepts only terminal statuses (success / failure); never running.
• RejectSecretValues hard-on for v1; if ever needed as escape hatch, it's a deployment-level env var audited at boot, never a per-connection field.
• Semantic validation: Vault URL must be https (http only via deployment-level env var), no userinfo, no token-shaped query params; AWS role ARN regex; endpoint URLs validated similarly.
• DB-backed targets take priority over SB_DISCOVER_TARGETS_JSON; env var fallback logs a deprecation warning; removal calendar: 3 months after P4 merges.

Sub-issues (sequential, with P5 + P6 parallelizable after P3)

• P1 — schema + storage layer (this repo)
• P2 — service layer validation + sanitization (this repo)
• P3 — handlers + shared GET branching + JobService hook (this repo)
• P4 — DB-backed DiscoverScheduler rewrite (secrets-bridge/worker)
• P5 — admin page + cross-team dropdown rewiring (secrets-bridge/ui)
• P6 — operator guide (secrets-bridge/docs)
• P-follow-up — Long-stale running sweeper (secrets-bridge/worker)
• Skills round-trip (PROGRESS.md + 4 SKILL.md updates)

Acceptance

EPIC closes when all sub-issues merge AND a live e2e walkthrough (P6 deliverable) demonstrates the full lifecycle: create connection → bind → cross-team submit picks up the destination → discover-now runs → disable → dropdown empties → delete blocked by in-use → unbind → delete succeeds. Canary scan across provider_connections.scope, audit_events.metadata, and last_discover_error returns zero hits for AKIA / hvs. / JWT / OAuth token sentinels.

Why this EPIC

• N5's destination dropdown stubs an endpoint that 404s today
• SB_DISCOVER_TARGETS_JSON is a YAML-in-a-string anti-pattern with no audit trail
• BRD §17 provider_connections has no admin surface despite shipping in migration 0001