mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-26 13:07:04 +09:00
Cozystack generates managed application passwords at Helm render time and keeps them in a Secret tenants can read again at any time, which a deployment whose policy requires a credential shown once cannot accept. The accepted design moves generation into the API: an ApplicationDefinition declares its accounts and the stored form of a password in a credentials block, and each account gets a core.cozystack.io Credential whose mint and revoke subresources take a TokenRequest-shaped CredentialRequest. This adds the types, the built-in password formats, which the migration CLI shares so a converted release and a mint store the same form, and the account helpers that name the Secrets and read their record. Design: https://github.com/cozystack/community/blob/main/design-proposals/user-secrets-api/README.md Assisted-by: LLM Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>