Callbacks service docs updated

api/pkg/db/internal/mongo/callbacksdb/callback.go

@@ -0,0 +1,8 @@
+package callbacksdb
+
+import "github.com/tech/sendico/pkg/model"
+
+type callbackInternal struct {
+	model.Callback `bson:",inline" json:",inline"`
+	SecretRef      string `bson:"secret_ref" json:"-"`
+}

api/pkg/db/internal/mongo/callbacksdb/db.go

@@ -2,14 +2,12 @@ package callbacksdb
 
 import (
 	"context"
-	"errors"
 
 	"github.com/tech/sendico/pkg/auth"
 	"github.com/tech/sendico/pkg/db/callbacks"
 	"github.com/tech/sendico/pkg/db/policy"
 	ri "github.com/tech/sendico/pkg/db/repository/index"
 	"github.com/tech/sendico/pkg/db/storable"
-	"github.com/tech/sendico/pkg/merrors"
 	"github.com/tech/sendico/pkg/mlogger"
 	"github.com/tech/sendico/pkg/model"
 	"github.com/tech/sendico/pkg/mservice"
@@ -29,10 +27,6 @@ func Create(
 	pdb policy.DB,
 	db *mongo.Database,
 ) (*CallbacksDB, error) {
-	if err := ensureBuiltInPolicy(ctx, logger, pdb); err != nil {
-		return nil, err
-	}
-
 	p, err := auth.CreateDBImp[*model.Callback](ctx, logger, pdb, enforcer, mservice.Callbacks, db)
 	if err != nil {
 		return nil, err
@@ -43,7 +37,7 @@ func Create(
 			Name: "uq_callbacks_client_url",
 			Keys: []ri.Key{
 				{Field: storable.OrganizationRefField, Sort: ri.Asc},
-				{Field: "client_id", Sort: ri.Asc},
+				{Field: "organization_ref", Sort: ri.Asc},
 				{Field: "url", Sort: ri.Asc},
 			},
 			Unique: true,
@@ -82,31 +76,4 @@ func Create(
 	}, nil
 }
 
-func ensureBuiltInPolicy(ctx context.Context, logger mlogger.Logger, pdb policy.DB) error {
-	var existing model.PolicyDescription
-	if err := pdb.GetBuiltInPolicy(ctx, mservice.Callbacks, &existing); err == nil {
-		return nil
-	} else if !errors.Is(err, merrors.ErrNoData) {
-		return err
-	}
-
-	description := "Callbacks subscription management"
-	resourceTypes := []mservice.Type{mservice.Callbacks}
-	policyDescription := &model.PolicyDescription{
-		Describable: model.Describable{
-			Name:        "Callbacks",
-			Description: &description,
-		},
-		ResourceTypes: &resourceTypes,
-	}
-	if err := pdb.Create(ctx, policyDescription); err != nil && !errors.Is(err, merrors.ErrDataConflict) {
-		if logger != nil {
-			logger.Warn("Failed to create built-in callbacks policy", zap.Error(err))
-		}
-		return err
-	}
-
-	return pdb.GetBuiltInPolicy(ctx, mservice.Callbacks, &existing)
-}
-
 var _ callbacks.DB = (*CallbacksDB)(nil)

api/pkg/db/internal/mongo/callbacksdb/secretref.go

@@ -0,0 +1,60 @@
+package callbacksdb
+
+import (
+	"context"
+	"strings"
+
+	"github.com/tech/sendico/pkg/db/repository"
+	"github.com/tech/sendico/pkg/merrors"
+	"github.com/tech/sendico/pkg/model"
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+func (db *CallbacksDB) GetSigningSecretRef(ctx context.Context, accountRef, callbackRef bson.ObjectID) (string, error) {
+	if callbackRef.IsZero() {
+		return "", merrors.InvalidArgument("callback reference is required", "callbackRef")
+	}
+
+	// Enforce read permissions through the public callback object first.
+	var callback model.Callback
+	if err := db.Get(ctx, accountRef, callbackRef, &callback); err != nil {
+		return "", err
+	}
+
+	internal := &callbackInternal{}
+	if err := db.DBImp.Repository.Get(ctx, callbackRef, internal); err != nil {
+		return "", err
+	}
+
+	return strings.TrimSpace(internal.SecretRef), nil
+}
+
+func (db *CallbacksDB) SetSigningSecretRef(ctx context.Context, accountRef, callbackRef bson.ObjectID, secretRef string) error {
+	if callbackRef.IsZero() {
+		return merrors.InvalidArgument("callback reference is required", "callbackRef")
+	}
+	value := strings.TrimSpace(secretRef)
+	if value == "" {
+		return merrors.InvalidArgument("secret reference is required", "secretRef")
+	}
+
+	return db.Patch(
+		ctx,
+		accountRef,
+		callbackRef,
+		repository.Patch().Set(repository.Field("secretRef"), value),
+	)
+}
+
+func (db *CallbacksDB) ClearSigningSecretRef(ctx context.Context, accountRef, callbackRef bson.ObjectID) error {
+	if callbackRef.IsZero() {
+		return merrors.InvalidArgument("callback reference is required", "callbackRef")
+	}
+
+	return db.Patch(
+		ctx,
+		accountRef,
+		callbackRef,
+		repository.Patch().Unset(repository.Field("secretRef")),
+	)
+}