Commit 68ad99da authored Oct 13, 2026 by Dimitrios Gogos

docs: amend ADR-0067 to clarify handling of partner client secret sources and...

docs: amend ADR-0067 to clarify handling of partner client secret sources and update requirements documentation

parent 5cd2bcca

decisions/0067-partner-client-secret-encrypted-in-fm-db.md

+2 −1

Changes for decisions/0067-partner-client-secret-encrypted-in-fm-db.md: 2 added lines, 1 removed line.
Original line number	Diff line number	Diff line
		@@ -85,7 +85,8 @@ This amends:
		secret-handling test line ("never appear in PostgreSQL" becomes "never appear in PostgreSQL
		unencrypted").
		- `fm/requirements-and-design.md`, `partner_ops` table: `our_client_secret_ref` is one of two
		secret sources, plus the new `partner_op_secrets` table.
		secret sources, plus the new `partner_op_secrets` table; L.2 states the partner endpoints'
		secret fields.

		Revisit triggers: a platform secret store, a key-rotation requirement, or the move to
		`private_key_jwt` that the FM docs already plan, which removes per-partner secrets altogether.

decisions/index.md

+1 −1

Changes for decisions/index.md: 1 added line, 1 removed line.
Original line number	Diff line number	Diff line
		@@ -62,4 +62,4 @@ the reasoning lives here. Never renumber; supersede instead (see the record-deci
		* [ADR-0064](0064-portal-is-one-container-with-a-thin-backend.md) - the portal is one image: a FastAPI backend serves the built React app at `/` and its API at `/api/*`, and forwards calls without merging data; no Next.js server
		* [ADR-0065](0065-portal-sessions-keyed-by-the-cookie.md) - portal login sessions live in PostgreSQL, tokens encrypted with a per-session key only the cookie holds; login attempts are single-use rows; a session lasts as long as Keycloak accepts its refresh token
		* [ADR-0066](0066-api-clients-through-keycloak-client-registration.md) - developers' API clients are Keycloak clients registered by a narrow provisioner, products fixed at creation within the creator's grants, secret shown once, registration token encrypted under one app-wide key; a refused token on delete is reported; no reconciliation with Keycloak in Release 2
		* [ADR-0067](0067-partner-client-secret-encrypted-in-fm-db.md) - FM accepts the partner client secret typed in through the registry and stores it AES-GCM encrypted in fm_db (`partner_op_secrets`) under one app-wide key, never returned; `our_client_secret_ref` files stay as the other source, one per partner; no key → 501 (amends FM #21's no-secret-accepted criterion)
		* [ADR-0067](0067-partner-client-secret-encrypted-in-fm-db.md) - proposed: FM accepts the partner client secret typed in through the registry and stores it AES-GCM encrypted in fm_db (`partner_op_secrets`) under one app-wide key, never returned; `our_client_secret_ref` files stay as the other source, one per partner; no key → 501 (amends FM #21's no-secret-accepted criterion)

fm/requirements-and-design.md

+7 −0

Changes for fm/requirements-and-design.md: 7 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -418,6 +418,13 @@ standalone list/GET endpoint because they are always read embedded in partner de
		support `DELETE` but not `PATCH` because a rule's identifier/value/priority is immutable — changing
		a mapping means removing the old rule and creating a new one.

		`POST` and `PATCH /internal/partners[/{id}]` take the secret backing `our_client_id` from one of
		two sources, never both in one request (`400`): `our_client_secret_ref` (mounted file) or
		`our_client_secret` (the value, write-only, stored encrypted in `partner_op_secrets`). Setting one
		drops the other; on `PATCH`, omitting `our_client_secret` keeps the stored value and `null` removes
		it. Responses never carry the value, only `our_client_secret_set`. Without
		`FM_PARTNER_SECRET_KEY`, a request carrying `our_client_secret` gets `501` (ADR-0067).

		### L.3 OEG → FM Internal HTTP (Outbound Federation Hand-off)

		Scope (ADR-0044): subscriber-identifier (MSISDN/IP) routing for synchronous query APIs only —