0006. Authenticate pull-out via per-connection tokens¶

Date: 2026-07-10 Status: Accepted

Context¶

App is Authenticatable (HasApiTokens) today and is the Sanctum principal that pull-out consumers (rapidmail, User Platform) authenticate as. ADR-0002 dissolves App entirely, so pull-out authentication has to land somewhere else.

Decision¶

Tenant is deliberately not Authenticatable. A company is not an API client. Pull-out requests instead authenticate with a per-connection bearer token: SystemConnectionToken gains a purpose field — handshake (today's existing single-use, ~1h-expiry behaviour, unchanged) or access (new: long-lived, for pull-out). A dedicated guard resolves access token → SystemConnection → Tenant scope for the request. Binding auth to the connection, not the tenant, is both more correct and drops the HasApiTokens coupling.

Internal products (rapidmail, User Platform) each get a SystemConnection like any other adapter; when they pull Conflux data they present that connection's access token — the same mechanism any other pull-out consumer uses.

Consequences¶

Token lifecycle and rotation policy for purpose=access tokens is an implementation detail, not specified by this decision — see System Connection Tokens once it is defined.