* feat(connect): wire the SKV extension through the connector broker + data proxy (PR6b-2)
In connector mode (GNUBOK_CONNECTOR_KEY set, no own SKV credentials) the
Skatteverket extension now routes through the hosted connector stack
(#1757) instead of calling Skatteverket directly:
- skvRequestWithAuth routes to the data proxy: base URL maps to a service
segment (moms/skattekonto/agd-inlamning/agd-period), the user's SKV
Bearer moves to X-Connector-Upstream-Authorization, the connector key
authenticates the proxy, and the gateway Client_Id/Client_Secret are
omitted (the proxy adds Arcim's). Connector-layer 4xx bodies (code
CONNECTOR_*) are classified before the SKV-shaped 401/403 sniffing so a
broker refusal surfaces operator guidance (check GNUBOK_CONNECTOR_KEY),
never APIGW/BankID guidance for knobs the instance does not have.
- OAuth: /authorize starts the consent via the broker's authorize-url
(persisting its redirect_uri + connector_state), the hosted SKV callback
bounces the code back to the instance, and exchangeCodeForTokens /
refreshAccessToken exchange through the broker's /oauth/token,
unwrapping its { data } envelope. Tokens still rest encrypted on the
instance; client_id/client_secret never exist there.
- Broker refresh 404 CONNECTOR_NOT_OWNED maps to SESSION_EXPIRED
(terminal; reconnect fixes); broker 502 stays a raw error so a transient
SKV outage never re-arms the reconnect banner (#1155).
- getSkatteverketEnvironment() reports 'prod' in connector mode: the
upstream env is hosted's, and the instance's unset defaults would show a
false Testmiljo badge on real filings.
- System (CCG/ombud) auth is deliberately not brokered: hosted-only,
stays direct.
Hosted and own-credentials self-hosts are byte-identical: every branch
gates on skatteverketConnectorMode(), which is null whenever own SKV
credentials exist or no connector key is set. Direct-path tests pin that.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KRfamAKDqvRNwbjr5XD2VS
* fix(connect): classify SKV dead-refresh-token dialects broker-side; forward diagnostic headers; connector-aware gateway guidance
Skeptic refutation on PR #2103 (found independently by the correctness and
compliance skeptics): the broker's /oauth/token catch-all collapsed SKV's
terminal dead-refresh-token dialects (404 id_not_found, 400 invalid_grant,
"Refresh Token status is expired": the dominant refresh outcome, per-flow
tokens live 65 minutes) into the generic 502 CONNECTOR_SKV_TOKEN_FAILED, so
a connector instance could never classify ordinary session expiry: raw
English 500s instead of the reconnect flow, staged filing operations
consumed as non-recoverable, crons retrying raw forever.
- Broker /oauth/token: re-codes those dialects as 401
CONNECTOR_SKV_REFRESH_DEAD, refresh grant only (invalid_grant on the code
exchange means an expired one-shot code and keeps the generic 502). The
classifier (isSkvDeadRefreshTokenError) uses the same regex set the
extension's direct path classifies with.
- Instance dead-token classifier maps CONNECTOR_SKV_REFRESH_DEAD to
SESSION_EXPIRED alongside 404 CONNECTOR_NOT_OWNED; the generic 502 stays
a raw error so a transient SKV outage never re-arms the reconnect banner.
- Data proxy: forwards WWW-Authenticate and x-skv-*/x-amzn-*/x-api-*
response headers (the instance's MISSING_SCOPE classification reads them;
body-less gateway rejections carry no other signal).
- Instance gateway-refusal guidance is connector-aware: a self-host has no
SKATTEVERKET_APIGW_CLIENT_ID and no Utvecklarportalen access, so connector
mode points at /api/connector/status and support instead.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KRfamAKDqvRNwbjr5XD2VS
* fix(connect): reject redirects on the instance's broker OAuth requests
CodeRabbit inline finding (CWE-200): the connector-mode authorize-url and
token requests followed redirects by default, so a 307/308 would resend the
connector key (and code/refresh token) to the redirect target. redirect
'error', matching the broker's own postToken rule; the token response must
only ever come from the broker endpoint itself.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KRfamAKDqvRNwbjr5XD2VS
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Mattsson
08b1119c7d