From 4769dadf63e43e2b4ed18bff9befdbfdf5995ce1 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@novox.be>
Date: Tue, 6 Oct 2026 02:16:27 +0200
Subject: [PATCH] State each provision's identity bound (hq issue 263)

Consumers were held to an S3 access key's 20 characters whatever they
required. Each provider now says what its backend keeps: minio 20,
PostgreSQL and MongoDB and DNS 63, Gitea 40, a mailbox 64, SQL Server 128,
Keycloak 255, unbounded where the store has no limit, and none for the
resolver and route provisions, which keep no name of their consumers.
Needs the controller that reads the field (mesh-controller, ADR 0225).
---
 modules/cloudflare-dns/module.json | 6 +++++-
 modules/dnsmasq/module.json        | 3 ++-
 modules/gitea/module.json          | 6 +++++-
 modules/influxdb/module.json       | 5 ++++-
 modules/keycloak/module.json       | 6 +++++-
 modules/mailu/module.json          | 6 +++++-
 modules/mesh-vault/module.json     | 5 ++++-
 modules/minio/module.json          | 6 +++++-
 modules/mongodb/module.json        | 6 +++++-
 modules/mosquitto/module.json      | 5 ++++-
 modules/mssql/module.json          | 6 +++++-
 modules/postgres/module.json       | 6 +++++-
 modules/redis/module.json          | 5 ++++-
 modules/route-adapter/module.json  | 3 ++-
 modules/route-proxy/module.json    | 3 ++-
 15 files changed, 62 insertions(+), 15 deletions(-)

diff --git a/modules/cloudflare-dns/module.json b/modules/cloudflare-dns/module.json
index 69b0237..7eea7e3 100644
--- a/modules/cloudflare-dns/module.json
+++ b/modules/cloudflare-dns/module.json
@@ -5,7 +5,11 @@
   "provides": [
     {
       "name": "public-dns",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": {
+        "max": 63,
+        "in": "a DNS label"
+      }
     }
   ],
   "serves": {
diff --git a/modules/dnsmasq/module.json b/modules/dnsmasq/module.json
index e4f3e04..f1df031 100644
--- a/modules/dnsmasq/module.json
+++ b/modules/dnsmasq/module.json
@@ -4,7 +4,8 @@
   "provides": [
     {
       "name": "wildcard-resolution",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": false
     }
   ],
   "requires": [
diff --git a/modules/gitea/module.json b/modules/gitea/module.json
index 16175fc..33ea9d7 100644
--- a/modules/gitea/module.json
+++ b/modules/gitea/module.json
@@ -182,7 +182,11 @@
   "provides": [
     {
       "name": "npm-package-registry",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": {
+        "max": 40,
+        "in": "a Gitea user name"
+      }
     },
     {
       "name": "git",
diff --git a/modules/influxdb/module.json b/modules/influxdb/module.json
index fbc8a67..e3445fd 100644
--- a/modules/influxdb/module.json
+++ b/modules/influxdb/module.json
@@ -4,7 +4,10 @@
   "provides": [
     {
       "name": "influxdb-api",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": {
+        "in": "an InfluxDB v1 authorization"
+      }
     }
   ],
   "capabilities": [
diff --git a/modules/keycloak/module.json b/modules/keycloak/module.json
index 7a18b75..da58fd1 100644
--- a/modules/keycloak/module.json
+++ b/modules/keycloak/module.json
@@ -4,7 +4,11 @@
   "provides": [
     {
       "name": "oidc-client",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": {
+        "max": 255,
+        "in": "a Keycloak client id"
+      }
     }
   ],
   "requires": [
diff --git a/modules/mailu/module.json b/modules/mailu/module.json
index ac5d45c..450a27a 100644
--- a/modules/mailu/module.json
+++ b/modules/mailu/module.json
@@ -537,7 +537,11 @@
   "provides": [
     {
       "name": "smtp",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": {
+        "max": 64,
+        "in": "a mailbox's local part"
+      }
     }
   ],
   "serves": {
diff --git a/modules/mesh-vault/module.json b/modules/mesh-vault/module.json
index f68e8ed..4f6ddeb 100644
--- a/modules/mesh-vault/module.json
+++ b/modules/mesh-vault/module.json
@@ -4,7 +4,10 @@
   "provides": [
     {
       "name": "secret",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": {
+        "in": "a vault entry"
+      }
     }
   ],
   "capabilities": [
diff --git a/modules/minio/module.json b/modules/minio/module.json
index ac6b7aa..d4f95eb 100644
--- a/modules/minio/module.json
+++ b/modules/minio/module.json
@@ -4,7 +4,11 @@
   "provides": [
     {
       "name": "s3-bucket",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": {
+        "max": 20,
+        "in": "an S3 access key"
+      }
     }
   ],
   "requires": [
diff --git a/modules/mongodb/module.json b/modules/mongodb/module.json
index 6454914..8915d62 100644
--- a/modules/mongodb/module.json
+++ b/modules/mongodb/module.json
@@ -4,7 +4,11 @@
   "provides": [
     {
       "name": "mongodb-database",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": {
+        "max": 63,
+        "in": "a MongoDB database name"
+      }
     }
   ],
   "capabilities": [
diff --git a/modules/mosquitto/module.json b/modules/mosquitto/module.json
index 9308199..0ffc9c6 100644
--- a/modules/mosquitto/module.json
+++ b/modules/mosquitto/module.json
@@ -5,7 +5,10 @@
   "provides": [
     {
       "name": "mqtt-topic",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": {
+        "in": "a Mosquitto client and topic prefix"
+      }
     }
   ],
   "capabilities": [
diff --git a/modules/mssql/module.json b/modules/mssql/module.json
index 5a44231..09a5b06 100644
--- a/modules/mssql/module.json
+++ b/modules/mssql/module.json
@@ -4,7 +4,11 @@
   "provides": [
     {
       "name": "mssql-database",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": {
+        "max": 128,
+        "in": "a SQL Server login and database name"
+      }
     }
   ],
   "capabilities": [
diff --git a/modules/postgres/module.json b/modules/postgres/module.json
index 5f8da0c..48ff5c6 100644
--- a/modules/postgres/module.json
+++ b/modules/postgres/module.json
@@ -4,7 +4,11 @@
   "provides": [
     {
       "name": "postgres-database",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": {
+        "max": 63,
+        "in": "a PostgreSQL role and database name"
+      }
     }
   ],
   "claims": [
diff --git a/modules/redis/module.json b/modules/redis/module.json
index 0736848..49d23f0 100644
--- a/modules/redis/module.json
+++ b/modules/redis/module.json
@@ -4,7 +4,10 @@
   "provides": [
     {
       "name": "redis-cache",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": {
+        "in": "a Redis ACL user and key prefix"
+      }
     }
   ],
   "requires": [
diff --git a/modules/route-adapter/module.json b/modules/route-adapter/module.json
index e7501b2..10cb2d9 100644
--- a/modules/route-adapter/module.json
+++ b/modules/route-adapter/module.json
@@ -8,7 +8,8 @@
   "provides": [
     {
       "name": "route",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": false
     }
   ],
   "serves": {
diff --git a/modules/route-proxy/module.json b/modules/route-proxy/module.json
index 08068f3..044d336 100644
--- a/modules/route-proxy/module.json
+++ b/modules/route-proxy/module.json
@@ -8,7 +8,8 @@
   "provides": [
     {
       "name": "route",
-      "scope": "mesh"
+      "scope": "mesh",
+      "identity": false
     }
   ],
   "serves": {