auth_bindings

Typed specification

Generated by the pinned ess generate --kind docs from ess. Structural validation establishes consistency; behaviour, storage and cross-record predicates remain implementation obligations.

Proposed host-private auth records and acknowledged lifecycle boundaries.

connectors.auth_bindings is one of connectors's bounded contexts. Back to the index.

Types

`AcquisitionFailure`

connectors.auth_bindings.AcquisitionFailure is one of rejected, exchange_unknown and expired.

`AuthRequirement`

connectors.auth_bindings.AuthRequirement is a record of two fields:

profile — String
scopes — List<String>

`BindingPublication`

connectors.auth_bindings.BindingPublication is a record of six fields:

connection_ref — String
expected_publication_fence — String
profile_record_ref — String
generation_id — Optional<connectors.credentials.CredentialGenerationId>, which may be absent
custody_version_ref — Optional<String>, which may be absent
external_identity — Optional<connectors.credentials.ExternalIdentity>, which may be absent

`CredentialSet`

connectors.auth_bindings.CredentialSet is a record of three fields:

kind — String
material_handle — String
size_bytes — Integer

`Decision`

connectors.auth_bindings.Decision is one of allow, refuse and unknown.

`LocalStaticProfile`

connectors.auth_bindings.LocalStaticProfile is a record of six fields:

profile_id — String
revision — String
purpose — connectors.auth_access.Purpose
subject — connectors.auth_access.Subject
minimum_scopes — List<String>
evidence_lifetime_ms — Integer

`ProfileDeclaration`

connectors.auth_bindings.ProfileDeclaration is a record of 12 fields:

purpose — connectors.auth_access.Purpose
subject — connectors.auth_access.Subject
scheme — connectors.auth_access.Scheme
acquisition — connectors.auth_access.AcquisitionDeclaration
scopes — connectors.auth_bindings.ScopeRequirements
capabilities — List<connectors.auth_access.CapabilityName>
evidence — List<connectors.credential_evidence.CheckKind>
evidence_requirements — connectors.connection_admission.EvidenceRequirements
identity_mechanism_ref — Optional<String>, which may be absent
refresh_policy_ref — Optional<String>, which may be absent
revocation_binding_ref — Optional<String>, which may be absent
sources — List<String>

`ScopeRequirements`

connectors.auth_bindings.ScopeRequirements is a record of two fields:

requestable — List<String>
minimum — List<String>

Entities

An entity is what this context is about: something with an identity that outlives any one request, a shape, and a lifecycle. The lifecycle is exhaustive — a move that is not drawn below is a move this specification does not permit, and that is the only way it says so. Every move is labelled with the command that takes it, because a move nothing can trigger is refused rather than drawn.

`Acquisition`

connectors.auth_bindings.Acquisition.

An instance is identified by acquisition_ref, a String. The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view.

It holds:

instance_id — String
profile_record_ref — String
owner_scope — String
admitted_origin_ref — String
registration_binding_ref — Optional<String>, which may be absent
protected_correlation_ref — String
expires_at — Timestamp
expected_publication_fence — String
target_connection_ref — String
repair_connection_ref — Optional<String>, which may be absent
result_connection_ref — Optional<String>, which may be absent
terminal_reason — Optional<connectors.auth_bindings.AcquisitionFailure>, which may be absent
owner_token — Uuid
created_at — Timestamp
consumed_at — Optional<Timestamp>, which may be absent
generation_id — connectors.credentials.CredentialGenerationId
captured_snapshot_ref — String
candidate_custody_version_ref — Optional<String>, which may be absent

It references at most one connectors.declarations.ServiceConfiguration, as instance, carried by Acquisition.instance_id. It references at most one AuthProfile, as auth_profile, carried by Acquisition.profile_record_ref. It references at most one Connection, as target_connection, carried by Acquisition.target_connection_ref. It references at most one Connection, as repair_target, carried by Acquisition.repair_connection_ref. It references at most one Connection, as result_connection, carried by Acquisition.result_connection_ref.

No invariant is declared, so nothing here constrains an instance at rest.

Its state is a connectors.auth_bindings.Acquisition.State, one of Completed, Completing, Expired, Failed and Pending. That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree.

An instance is created in Pending. Completed, Expired and Failed are terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which.

Each move is taken by a declared command outcome, and a move nothing takes is refused as missing_causation rather than left as a state change nobody can trigger:

consume — taken by connectors.auth_bindings.ConsumeAcquisition on its consumed outcome
record_candidate — taken by connectors.auth_bindings.RecordAcquisitionCandidate on its candidate-recorded outcome
complete — taken by connectors.auth_bindings.CompleteAcquisition on its completed outcome
fail — taken by connectors.auth_bindings.FailAcquisition on its failed outcome
expire — taken by connectors.auth_bindings.ExpireAcquisition on its expired outcome

An instance is brought into existence by connectors.auth_bindings.BeginAcquisition on its pending outcome.

Illegal transitions are illegal by absence: no rule forbids them, there is simply no arrow, because a rule would be a second place for the same truth to live. A diagram cannot show an absence, so the pairs it does not connect are listed here, derived from the same transitions — anything named below is a move this specification does not permit.

Completed may not become Completing
Completed may not become Expired
Completed may not become Failed
Completed may not become Pending
Completing may not become Pending
Expired may not become Completed
Expired may not become Completing
Expired may not become Failed
Expired may not become Pending
Failed may not become Completed
Failed may not become Completing
Failed may not become Expired
Failed may not become Pending
Pending may not become Completed

Two views project it: AcquisitionStates and Acquisitions.

`AuthProfile`

connectors.auth_bindings.AuthProfile.

An instance is identified by profile_record_ref, a String. The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view.

It holds:

adapter_id — String
profile_id — String
declaration_revision — String
declaration — Optional<connectors.auth_bindings.ProfileDeclaration>, which may be absent
local_static_profile — Optional<connectors.auth_bindings.LocalStaticProfile>, which may be absent

It references at most one connectors.declarations.AdapterSpecification, as adapter, carried by AuthProfile.adapter_id.

No invariant is declared, so nothing here constrains an instance at rest.

Its state is a connectors.auth_bindings.AuthProfile.State, one of Declared. That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree.

An instance is created in Declared. Declared is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which.

It declares no moves, so nothing changes its state once it exists.

It has one state, so there is no move to permit or to forbid.

One view projects it: AuthProfiles.

`Connection`

connectors.auth_bindings.Connection.

An instance is identified by connection_ref, a String. The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view.

It holds:

instance_id — String
profile_record_ref — String
profile_ref — String
owner_scope — String
actor — String
provider_authority — String
access_mode — connectors.auth_access.AccessMode
semantic_revision — String
publication_fence — String
enabled — Boolean
published — Boolean
external_identity — Optional<connectors.credentials.ExternalIdentity>, which may be absent
parent_connection_ref — Optional<String>, which may be absent
mediated_route — Optional<connectors.discovery.MediatedRouteBinding>, which may be absent
active_generation_id — Optional<connectors.credentials.CredentialGenerationId>, which may be absent
baseline_evidence — Optional<connectors.credential_evidence.EvidenceSnapshot>, which may be absent
active_custody_version_ref — Optional<String>, which may be absent
superseded_custody_version_refs — List<String>
created_at — Timestamp
revoked_at — Optional<Timestamp>, which may be absent
configuration_revision — Optional<String>, which may be absent
refused_configuration_revision — Optional<String>, which may be absent
begun_at_instance_revision — Optional<String>, which may be absent
credential_revision — Optional<String>, which may be absent
executable_digest — Optional<String>, which may be absent

It references at most one connectors.declarations.ServiceConfiguration, as instance, carried by Connection.instance_id. It references at most one AuthProfile, as auth_profile, carried by Connection.profile_record_ref. It references at most one Connection, as parent, carried by Connection.parent_connection_ref. It references at most one connectors.credentials.CredentialGeneration, as active_generation, carried by Connection.active_generation_id. It references at most one CustodyVersion, as active_custody_version, carried by Connection.active_custody_version_ref. It references any number of CustodyVersion, as superseded_custody_versions, carried by Connection.superseded_custody_version_refs.

Every instance satisfies (defined(active_generation_id) or not (defined(active_custody_version_ref))) and (access_mode == credential or not ((defined(active_generation_id) or defined(active_custody_version_ref)))) — a predicate over this entity's own fields, checked against them rather than stored as a sentence, so an invariant reading something the entity does not have is refused instead of documented.

Its state is a connectors.auth_bindings.Connection.State, one of Live, Revoked and Stale. That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree.

An instance is created in Live. Revoked is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which.

Each move is taken by a declared command outcome, and a move nothing takes is refused as missing_causation rather than left as a state change nobody can trigger:

publish — taken by connectors.auth_bindings.PublishBinding on its published outcome
mark_stale — taken by connectors.auth_bindings.MarkConnectionStale on its marked-stale outcome
record_candidate — taken by connectors.auth_bindings.RecordConnectionCandidate on its candidate-recorded outcome
revoke — taken by connectors.auth_bindings.RevokeConnection on its revoked outcome

An instance is brought into existence by connectors.auth_bindings.AllocateConnection on its allocated outcome.

Revoked may not become Live
Revoked may not become Stale

Two views project it: ConnectionStates and Connections.

`CustodyVersion`

connectors.auth_bindings.CustodyVersion.

An instance is identified by version_ref, a String. The name is part of the model and not a convention: a view projects the identity under that name, so a projection inventing its own would disagree with the view.

It holds:

instance_id — String
scope_ref — String
store_version — String
credential_set — Optional<connectors.auth_bindings.CredentialSet>, which may be absent
retirement_fence — Optional<String>, which may be absent
retire_not_before — Optional<Timestamp>, which may be absent
connection_ref — String
acquisition_ref — String
generation_id — connectors.credentials.CredentialGenerationId
acknowledged_at — Optional<Timestamp>, which may be absent
invalid_reason — Optional<String>, which may be absent
byte_size — Optional<Integer>, which may be absent
retired_at — Optional<Timestamp>, which may be absent

It references at most one connectors.declarations.ServiceConfiguration, as instance, carried by CustodyVersion.instance_id.

Every instance satisfies (not (defined(byte_size)) or (byte_size >= 1 and byte_size <= 65536)) — a predicate over this entity's own fields, checked against them rather than stored as a sentence, so an invariant reading something the entity does not have is refused instead of documented.

Its state is a connectors.auth_bindings.CustodyVersion.State, one of Candidate, Deleted, Invalid, Retiring and Stored. That enum is synthesised from the lifecycle rather than declared beside it, so the states a view's filter compares and the states drawn below cannot disagree.

An instance is created in Candidate. Deleted is terminal, so an instance may rest there forever. That is declared rather than inferred from having no way out: an entity that cannot leave a state is either finished or stuck, and only its author knows which.

Each move is taken by a declared command outcome, and a move nothing takes is refused as missing_causation rather than left as a state change nobody can trigger:

acknowledge — taken by connectors.auth_bindings.AcknowledgeCustodyWrite on its stored outcome
invalidate — taken by connectors.auth_bindings.InvalidateCustodyVersion on its invalidated outcome
retire — taken by connectors.auth_bindings.RetireCustodyVersion on its retiring outcome
delete — taken by connectors.auth_bindings.AcknowledgeCustodyDeletion on its deleted outcome

An instance is brought into existence by connectors.auth_bindings.RecordCustodyVersion on its candidate outcome.

Candidate may not become Deleted
Deleted may not become Candidate
Deleted may not become Invalid
Deleted may not become Retiring
Deleted may not become Stored
Invalid may not become Candidate
Invalid may not become Deleted
Invalid may not become Stored
Retiring may not become Candidate
Retiring may not become Invalid
Retiring may not become Stored
Stored may not become Candidate
Stored may not become Deleted

Two views project it: CustodyVersionStates and CustodyVersions.

Views

A view is what the outside world is promised it can observe. Each one says which instances it contains and how soon it reflects a command that has already returned, because "you can read this" without "how soon" is the promise every flaky suite is built on.

`AcquisitionStates`

connectors.auth_bindings.AcquisitionStates.

It reads Acquisition.

It contains every instance of that entity: no filter narrows it, which is a decision somebody made and not a line somebody omitted.

It exposes:

acquisition_ref — String
state — connectors.auth_bindings.Acquisition.State

It declares no order, so the rows come back in whatever order the implementation has, and two reads may disagree.

Read-your-writes: it is current the moment the command that changed it returns. A caller that has just created an invoice and cannot see it in here has been told a lie about what it did.

A generated scenario asserts it once, immediately after the command: a view promising this and not keeping the promise has to fail the suite rather than be retried until it passes.

`Acquisitions`

connectors.auth_bindings.Acquisitions.

It reads Acquisition.

It contains every instance of that entity: no filter narrows it, which is a decision somebody made and not a line somebody omitted.

It exposes:

acquisition_ref — String
instance_id — String
profile_record_ref — String
target_connection_ref — String
repair_connection_ref — Optional<String>, which may be absent
result_connection_ref — Optional<String>, which may be absent
terminal_reason — Optional<connectors.auth_bindings.AcquisitionFailure>, which may be absent
expires_at — Timestamp
state — connectors.auth_bindings.Acquisition.State

It declares no order, so the rows come back in whatever order the implementation has, and two reads may disagree.

Read-your-writes: it is current the moment the command that changed it returns. A caller that has just created an invoice and cannot see it in here has been told a lie about what it did.

A generated scenario asserts it once, immediately after the command: a view promising this and not keeping the promise has to fail the suite rather than be retried until it passes.

`AuthProfiles`

connectors.auth_bindings.AuthProfiles.

It reads AuthProfile.

It contains every instance of that entity: no filter narrows it, which is a decision somebody made and not a line somebody omitted.

It exposes:

profile_record_ref — String
adapter_id — String
profile_id — String
declaration_revision — String
state — connectors.auth_bindings.AuthProfile.State

It declares no order, so the rows come back in whatever order the implementation has, and two reads may disagree.

Read-your-writes: it is current the moment the command that changed it returns. A caller that has just created an invoice and cannot see it in here has been told a lie about what it did.

A generated scenario asserts it once, immediately after the command: a view promising this and not keeping the promise has to fail the suite rather than be retried until it passes.

`ConnectionStates`

connectors.auth_bindings.ConnectionStates.

It reads Connection.

It contains every instance of that entity: no filter narrows it, which is a decision somebody made and not a line somebody omitted.

It exposes:

connection_ref — String
state — connectors.auth_bindings.Connection.State

It declares no order, so the rows come back in whatever order the implementation has, and two reads may disagree.

Read-your-writes: it is current the moment the command that changed it returns. A caller that has just created an invoice and cannot see it in here has been told a lie about what it did.

A generated scenario asserts it once, immediately after the command: a view promising this and not keeping the promise has to fail the suite rather than be retried until it passes.

`Connections`

connectors.auth_bindings.Connections.

It reads Connection.

It contains every instance of that entity: no filter narrows it, which is a decision somebody made and not a line somebody omitted.

It exposes:

connection_ref — String
instance_id — String
profile_record_ref — String
owner_scope — String
access_mode — connectors.auth_access.AccessMode
publication_fence — String
active_generation_id — Optional<connectors.credentials.CredentialGenerationId>, which may be absent
active_custody_version_ref — Optional<String>, which may be absent
state — connectors.auth_bindings.Connection.State

It declares no order, so the rows come back in whatever order the implementation has, and two reads may disagree.

Read-your-writes: it is current the moment the command that changed it returns. A caller that has just created an invoice and cannot see it in here has been told a lie about what it did.

A generated scenario asserts it once, immediately after the command: a view promising this and not keeping the promise has to fail the suite rather than be retried until it passes.

`CustodyVersionStates`

connectors.auth_bindings.CustodyVersionStates.

It reads CustodyVersion.

It contains every instance of that entity: no filter narrows it, which is a decision somebody made and not a line somebody omitted.

It exposes:

version_ref — String
state — connectors.auth_bindings.CustodyVersion.State

It declares no order, so the rows come back in whatever order the implementation has, and two reads may disagree.

Read-your-writes: it is current the moment the command that changed it returns. A caller that has just created an invoice and cannot see it in here has been told a lie about what it did.

A generated scenario asserts it once, immediately after the command: a view promising this and not keeping the promise has to fail the suite rather than be retried until it passes.

`CustodyVersions`

connectors.auth_bindings.CustodyVersions.

It reads CustodyVersion.

It contains every instance of that entity: no filter narrows it, which is a decision somebody made and not a line somebody omitted.

It exposes:

version_ref — String
instance_id — String
scope_ref — String
store_version — String
byte_size — Optional<Integer>, which may be absent
acknowledged_at — Optional<Timestamp>, which may be absent
invalid_reason — Optional<String>, which may be absent
retirement_fence — Optional<String>, which may be absent
retired_at — Optional<Timestamp>, which may be absent
retire_not_before — Optional<Timestamp>, which may be absent
state — connectors.auth_bindings.CustodyVersion.State

It declares no order, so the rows come back in whatever order the implementation has, and two reads may disagree.

Read-your-writes: it is current the moment the command that changed it returns. A caller that has just created an invoice and cannot see it in here has been told a lie about what it did.

A generated scenario asserts it once, immediately after the command: a view promising this and not keeping the promise has to fail the suite rather than be retried until it passes.

Commands

`AcknowledgeCustodyDeletion`

connectors.auth_bindings.AcknowledgeCustodyDeletion.

It takes:

decision — connectors.auth_bindings.Decision
version_ref — String

It has four outcomes.

deleted — Taken when decision == allow holds of the input. It moves a connectors.auth_bindings.CustodyVersion from Retiring to Deleted, along the declared move delete. The instance is the one named by the input field version_ref. It emits connectors.auth_bindings.CustodyDeleted. A test reaches it by constructing an input that satisfies that condition.

unavailable — Taken when decision == unknown holds of the input. No entity in this specification changes. It reports connectors.auth_bindings.Unavailable, carrying reason. It emits nothing. A test reaches it by constructing an input that satisfies that condition.

refused — The default branch, taken when no other outcome's condition matched. No entity in this specification changes. It reports connectors.auth_bindings.Refused, carrying reason. It emits nothing. A test reaches it by constructing an input that satisfies no other outcome's condition.

wrong-state — Taken when the subject is resting in a state none of this command's moves start from — a connectors.auth_bindings.CustodyVersion in Candidate, Deleted, Invalid and Stored, which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it. No entity in this specification changes. It reports connectors.auth_bindings.CustodyStateConflict, carrying state. It emits nothing. A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch.

`AcknowledgeCustodyWrite`

connectors.auth_bindings.AcknowledgeCustodyWrite.

It takes:

decision — connectors.auth_bindings.Decision
version_ref — String
acknowledged_at — Timestamp

It has four outcomes.

stored — Taken when decision == allow holds of the input. It moves a connectors.auth_bindings.CustodyVersion from Candidate to Stored, along the declared move acknowledge. The instance is the one named by the input field version_ref. It emits connectors.auth_bindings.CustodyWritten. It sets acknowledged_at from input.acknowledged_at. A test reaches it by constructing an input that satisfies that condition.

wrong-state — Taken when the subject is resting in a state none of this command's moves start from — a connectors.auth_bindings.CustodyVersion in Deleted, Invalid, Retiring and Stored, which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it. No entity in this specification changes. It reports connectors.auth_bindings.CustodyStateConflict, carrying state. It emits nothing. A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch.

`AllocateConnection`

connectors.auth_bindings.AllocateConnection.

It takes:

decision — connectors.auth_bindings.Decision
instance_id — String
profile_record_ref — String
owner_scope — String
access_mode — connectors.auth_access.AccessMode
publication_fence — String
held_connection_ref — Optional<String>, which may be absent

It has four outcomes.

instance-connected — Taken when (decision == allow and defined(held_connection_ref)) holds of the input. No entity in this specification changes. It reports connectors.auth_bindings.InstanceConnected, carrying instance_id. It emits nothing. A test reaches it by constructing an input that satisfies that condition.

allocated — Taken when (decision == allow and not (defined(held_connection_ref))) holds of the input. It creates a connectors.auth_bindings.Connection, which starts in Live. The new instance's identity is published as connection_ref on connectors.auth_bindings.ConnectionAllocated. It emits connectors.auth_bindings.ConnectionAllocated. It sets instance_id from input.instance_id, profile_record_ref from input.profile_record_ref, owner_scope from input.owner_scope, access_mode from input.access_mode and publication_fence from input.publication_fence. A test reaches it by constructing an input that satisfies that condition.

`BeginAcquisition`

connectors.auth_bindings.BeginAcquisition.

It takes:

decision — connectors.auth_bindings.Decision
instance_id — String
profile_record_ref — String
target_connection_ref — String
repair_connection_ref — Optional<String>, which may be absent
expires_at — Timestamp

It has three outcomes.

pending — Taken when decision == allow holds of the input. It creates a connectors.auth_bindings.Acquisition, which starts in Pending. The new instance's identity is published as acquisition_ref on connectors.auth_bindings.AcquisitionBegan. It emits connectors.auth_bindings.AcquisitionBegan. It sets instance_id from input.instance_id, profile_record_ref from input.profile_record_ref, expires_at from input.expires_at, target_connection_ref from input.target_connection_ref and repair_connection_ref from input.repair_connection_ref. A test reaches it by constructing an input that satisfies that condition.

`CompleteAcquisition`

connectors.auth_bindings.CompleteAcquisition.

It takes:

decision — connectors.auth_bindings.Decision
acquisition_ref — String
result_connection_ref — String
publication — connectors.auth_bindings.BindingPublication

It has five outcomes.

result-mismatch — Taken when the existing subject's stored fields satisfy target_connection_ref != input.result_connection_ref. No entity in this specification changes. It reports connectors.auth_bindings.AcquisitionResultMismatch, carrying acquisition_ref. It emits nothing. A test establishes and independently observes the subject enum fact before selecting this branch.

completed — Taken when decision == allow holds of the input. It moves a connectors.auth_bindings.Acquisition from Completing to Completed, along the declared move complete. The instance is the one named by the input field acquisition_ref. It emits connectors.auth_bindings.AcquisitionCompleted. It sets result_connection_ref from input.result_connection_ref. A test reaches it by constructing an input that satisfies that condition.

wrong-state — Taken when the subject is resting in a state none of this command's moves start from — a connectors.auth_bindings.Acquisition in Completed, Expired, Failed and Pending, which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it. No entity in this specification changes. It reports connectors.auth_bindings.AcquisitionStateConflict, carrying state. It emits nothing. A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch.

`ConsumeAcquisition`

connectors.auth_bindings.ConsumeAcquisition.

It takes:

decision — connectors.auth_bindings.Decision
acquisition_ref — String

It has four outcomes.

consumed — Taken when decision == allow holds of the input. It moves a connectors.auth_bindings.Acquisition from Pending to Completing, along the declared move consume. The instance is the one named by the input field acquisition_ref. It emits connectors.auth_bindings.AcquisitionConsumed. A test reaches it by constructing an input that satisfies that condition.

wrong-state — Taken when the subject is resting in a state none of this command's moves start from — a connectors.auth_bindings.Acquisition in Completed, Completing, Expired and Failed, which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it. No entity in this specification changes. It reports connectors.auth_bindings.AcquisitionStateConflict, carrying state. It emits nothing. A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch.

`ExpireAcquisition`

connectors.auth_bindings.ExpireAcquisition.

It takes:

decision — connectors.auth_bindings.Decision
acquisition_ref — String

It has four outcomes.

expired — Taken when decision == allow holds of the input. It moves a connectors.auth_bindings.Acquisition from Completing and Pending to Expired, along the declared move expire. The instance is the one named by the input field acquisition_ref. It emits connectors.auth_bindings.AcquisitionExpired. It sets terminal_reason from "expired". A test reaches it by constructing an input that satisfies that condition.

wrong-state — Taken when the subject is resting in a state none of this command's moves start from — a connectors.auth_bindings.Acquisition in Completed, Expired and Failed, which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it. No entity in this specification changes. It reports connectors.auth_bindings.AcquisitionStateConflict, carrying state. It emits nothing. A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch.

`FailAcquisition`

connectors.auth_bindings.FailAcquisition.

It takes:

decision — connectors.auth_bindings.Decision
acquisition_ref — String
reason — connectors.auth_bindings.AcquisitionFailure

It has four outcomes.

failed — Taken when decision == allow holds of the input. It moves a connectors.auth_bindings.Acquisition from Completing and Pending to Failed, along the declared move fail. The instance is the one named by the input field acquisition_ref. It emits connectors.auth_bindings.AcquisitionFailed. It sets terminal_reason from input.reason. A test reaches it by constructing an input that satisfies that condition.

wrong-state — Taken when the subject is resting in a state none of this command's moves start from — a connectors.auth_bindings.Acquisition in Completed, Expired and Failed, which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it. No entity in this specification changes. It reports connectors.auth_bindings.AcquisitionStateConflict, carrying state. It emits nothing. A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch.

`InvalidateCustodyVersion`

connectors.auth_bindings.InvalidateCustodyVersion.

It takes:

version_ref — String
reason — String

It has two outcomes.

invalidated — The default branch, taken when no other outcome's condition matched. It moves a connectors.auth_bindings.CustodyVersion from Candidate and Stored to Invalid, along the declared move invalidate. The instance is the one named by the input field version_ref. It emits connectors.auth_bindings.CustodyInvalidated. It sets invalid_reason from input.reason. A test reaches it by constructing an input that satisfies no other outcome's condition.

wrong-state — Taken when the subject is resting in a state none of this command's moves start from — a connectors.auth_bindings.CustodyVersion in Deleted, Invalid and Retiring, which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it. No entity in this specification changes. It reports connectors.auth_bindings.CustodyStateConflict, carrying state. It emits nothing. A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch.

`MarkConnectionStale`

connectors.auth_bindings.MarkConnectionStale.

It takes:

connection_ref — String

It has two outcomes.

marked-stale — The default branch, taken when no other outcome's condition matched. It moves a connectors.auth_bindings.Connection from Live to Stale, along the declared move mark_stale. The instance is the one named by the input field connection_ref. It emits connectors.auth_bindings.ConnectionMarkedStale. A test reaches it by constructing an input that satisfies no other outcome's condition.

wrong-state — Taken when the subject is resting in a state none of this command's moves start from — a connectors.auth_bindings.Connection in Revoked and Stale, which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it. No entity in this specification changes. It reports connectors.auth_bindings.ConnectionStateConflict, carrying state. It emits nothing. A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch.

`PublishBinding`

connectors.auth_bindings.PublishBinding.

It takes:

decision — connectors.auth_bindings.Decision
connection_ref — String
publication — connectors.auth_bindings.BindingPublication

It has five outcomes.

stale-fence — Taken when the existing subject's stored fields satisfy publication_fence != input.publication.expected_publication_fence. No entity in this specification changes. It reports connectors.auth_bindings.PublicationFenceConflict, carrying connection_ref. It emits nothing. A test establishes and independently observes the subject enum fact before selecting this branch.

published — Taken when decision == allow holds of the input. It moves a connectors.auth_bindings.Connection from Live and Stale to Live, along the declared move publish. The instance is the one named by the input field connection_ref. It emits connectors.auth_bindings.BindingPublished. It sets publication_fence from implementation-generated. A test reaches it by constructing an input that satisfies that condition.

wrong-state — Taken when the subject is resting in a state none of this command's moves start from — a connectors.auth_bindings.Connection in Revoked, which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it. No entity in this specification changes. It reports connectors.auth_bindings.ConnectionStateConflict, carrying state. It emits nothing. A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch.

`RecordAcquisitionCandidate`

connectors.auth_bindings.RecordAcquisitionCandidate.

It takes:

acquisition_ref — String
candidate_custody_version_ref — String

It has two outcomes.

candidate-recorded — The default branch, taken when no other outcome's condition matched. It moves a connectors.auth_bindings.Acquisition from Completing to Completing, along the declared move record_candidate. The instance is the one named by the input field acquisition_ref. It emits connectors.auth_bindings.AcquisitionCandidateRecorded. A test reaches it by constructing an input that satisfies no other outcome's condition.

`RecordConnectionCandidate`

connectors.auth_bindings.RecordConnectionCandidate.

It takes:

connection_ref — String
candidate_custody_version_ref — String

It has two outcomes.

candidate-recorded — The default branch, taken when no other outcome's condition matched. It moves a connectors.auth_bindings.Connection from Stale to Stale, along the declared move record_candidate. The instance is the one named by the input field connection_ref. It emits connectors.auth_bindings.ConnectionCandidateRecorded. A test reaches it by constructing an input that satisfies no other outcome's condition.

wrong-state — Taken when the subject is resting in a state none of this command's moves start from — a connectors.auth_bindings.Connection in Live and Revoked, which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it. No entity in this specification changes. It reports connectors.auth_bindings.ConnectionStateConflict, carrying state. It emits nothing. A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch.

`RecordCustodyVersion`

connectors.auth_bindings.RecordCustodyVersion.

It takes:

decision — connectors.auth_bindings.Decision
instance_id — String
scope_ref — String
store_version — String
credential_set — connectors.auth_bindings.CredentialSet

It has three outcomes.

candidate — Taken when decision == allow holds of the input. It creates a connectors.auth_bindings.CustodyVersion, which starts in Candidate. The new instance's identity is published as version_ref on connectors.auth_bindings.CustodyCandidateRecorded. It emits connectors.auth_bindings.CustodyCandidateRecorded. It sets instance_id from input.instance_id, scope_ref from input.scope_ref, store_version from input.store_version and credential_set from input.credential_set. A test reaches it by constructing an input that satisfies that condition.

`RecordProfile`

connectors.auth_bindings.RecordProfile.

It takes:

adapter_id — String
profile_id — String
declaration_revision — String
declaration — Optional<connectors.auth_bindings.ProfileDeclaration>, which may be absent
local_static_profile — Optional<connectors.auth_bindings.LocalStaticProfile>, which may be absent

It has one outcome.

recorded — The default branch, taken when no other outcome's condition matched. It creates a connectors.auth_bindings.AuthProfile, which starts in Declared. The new instance's identity is published as profile_record_ref on connectors.auth_bindings.ProfileRecorded. It emits connectors.auth_bindings.ProfileRecorded. It sets adapter_id from input.adapter_id, profile_id from input.profile_id, declaration_revision from input.declaration_revision, declaration from input.declaration and local_static_profile from input.local_static_profile. A test reaches it by constructing an input that satisfies no other outcome's condition.

`RetireCustodyVersion`

connectors.auth_bindings.RetireCustodyVersion.

It takes:

version_ref — String
retirement_fence — String
retired_at — Timestamp
retire_not_before — Timestamp

It has two outcomes.

retiring — The default branch, taken when no other outcome's condition matched. It moves a connectors.auth_bindings.CustodyVersion from Candidate, Invalid and Stored to Retiring, along the declared move retire. The instance is the one named by the input field version_ref. It emits connectors.auth_bindings.CustodyRetiring. It sets retirement_fence from input.retirement_fence, retire_not_before from input.retire_not_before and retired_at from input.retired_at. A test reaches it by constructing an input that satisfies no other outcome's condition.

wrong-state — Taken when the subject is resting in a state none of this command's moves start from — a connectors.auth_bindings.CustodyVersion in Deleted and Retiring, which is what is left of the lifecycle once this command's own moves are taken away. The document lists none of it. No entity in this specification changes. It reports connectors.auth_bindings.CustodyStateConflict, carrying state. It emits nothing. A test reaches it by driving an instance into one of those states and then issuing the command, because no input selects this branch.

`RevokeConnection`

connectors.auth_bindings.RevokeConnection.

It takes:

decision — connectors.auth_bindings.Decision
connection_ref — String

It has four outcomes.

revoked — Taken when decision == allow holds of the input. It moves a connectors.auth_bindings.Connection from Live and Stale to Revoked, along the declared move revoke. The instance is the one named by the input field connection_ref. It emits connectors.auth_bindings.ConnectionRevoked. A test reaches it by constructing an input that satisfies that condition.

Events

`AcquisitionBegan`

connectors.auth_bindings.AcquisitionBegan.

It carries:

acquisition_ref — String

Emitted by connectors.auth_bindings.BeginAcquisition on its pending outcome.