Extend your cloud console with catalog and connection support

Overview

The settings catalog describes supported options and apply timing. Connection profiles describe authorization needs; a cloud operator does not become the user's identity. Sensitive handoffs should enter durable cloud records only as an encrypted envelope bound to a short-lived cluster challenge.

The settings catalog describes supported behavior

Build controls from the installed capability/settings descriptors and preserve unknown extension fields during edits. A type-safe control is useful only when its value has a real Host consumer with documented apply timing. Mask protected values and separate a secret reference from a secret itself so configuration review does not expose credentials.

Consent handoff is a different data path

A user client completes consent. If that material must cross a durable Cloud Server relay, use the supported short-lived challenge/encrypted envelope flow. The Host validates ownership, expiry and one-time use; the Cloud Server stores only the protected envelope. An operator's ability to manage a profile is not authority to impersonate its owner.

Build capability-aware management forms

1. Render controls from discovered capabilities/catalog descriptors, keep secret values masked and preserve unknown extension JSON.
2. Use conditional profile writes and supported connection administration. Let the external user client perform sign-in/consent.
3. For relayed handoff, encrypt in that client using the cluster challenge and send only the envelope. The Host validates owner proof, expiry, tampering and one-time use.

GET /fabrcoreapi/admin/v1/settings/catalog
Authorization: Bearer <administration-credential>

// The app obtains this challenge through its authorized cloud backend.
var challenge = await admin.CreateHandoffAsync(owner, "work");

// Encrypt in the client BEFORE sending the result to the cloud backend.
var envelope = ConnectionHandoff.Encrypt(challenge, new() {
    UserProof = fabrcoreAudienceUserToken,
    Operation = "complete",
    State = returnedState,
    AuthorizationCode = returnedCode
});
// Only envelope crosses the durable cloud command channel.
await admin.CompleteHandoffAsync(owner, "work", envelope);

Go deeper

Explore the related documentation.

• FabrCore Cloud Administration
• FabrCore Server
• FabrCore Connections
• Cloud administration and encrypted handoffs