Module social_connections 

Framework-owned external-account controllers. These routes never issue a local login session.

Modules

browser 🔒

Native desktop website authorization with persistent profiles and encrypted owner session checkpoints.

consent_ui 🔒

Bounded, actor-scoped OAuth progress and return-page feedback; never stores provider payloads.

settings 🔒

App-scoped provisioning in the encrypted vault, separate from each owner account grant.

Structs

BrowserStatus 🔒

Nonsecret website state composed into the same app-owned status renderer as optional API grants.

ObservationBatch 🔒

Retained inert observations plus guards for atomic acceptance by a domain consumer.

Pending 🔒

Registration 🔒

Constants

PREFIX 🔒

Statics

OPERATOR_CONFIG 🔒

Functions

authority_guards 🔒

Freezes one actual capability grant plus active-user/session assertions into the eventual database write.

browser_mode 🔒

Accepts only declared API or website transport; malformed modes never fall back to another authority.

client 🔒

Freezes an operator registration while leaving protocol endpoints and permissions provider-owned.

collection_authority 🔒

Rechecks durable active-owner authority independently of the selected API or website transport.

collection_client 🔒

Restores the verified Instagram account for collection while leaving interactive consent free to select an account.

collection_context 🔒

Verifies retained background authority without requiring the owner to leave a browser session open.

connection_namespace 🔒

Combines storage authority with a host-owned deployment epoch; app names cannot revive old preview grants.

current_account 🔒

Refreshes near-expiry authority under the durable lease and immutable revision promotion.

failure 🔒

Returns only fixed service diagnostics, never provider bodies, callback parameters or token references.

handle 🔒

Applies owner/session/CSRF gates and dispatches the declared external-account transport.

install_operator_config 🔒

Retains only the trusted serving configuration path so isolated previews can find operator registrations.

observations_for_profile 🔒

Resolves an explicit social profile and schedules its retained observations for an authorized consumer.

pending_registry 🔒

Keeps one-use consent state out of persistence, exports and logs; restart safely invalidates it.

process_one 🔒

Processes one due social page independently of domain tables, preserving cancellation and restart leases.

process_provider 🔒

Processes a bounded page independently for each configured provider.

provider_transport 🔒

Pins each request to the selected provider’s exact reviewed protocol endpoints and one resource URL.

registration 🔒

Loads operator-only registrations from external protected storage, never from generated source.

require_session 🔒

Rechecks the actual durable session after network operations, including logout or owner deactivation.

response 🔒

Routes bounded owner operations before app handlers; capability comes from the app’s declared policies.

response_at 🔒

Accepts a host-selected callback route for an isolated preview without trusting browser form values.

return_destination 🔒

Accepts only bounded same-app return paths, before any external grant or credential is changed.

scope 🔒

Derives app/deployment scope exclusively from authenticated storage and host deployment identity.

shutdown_browsers 🔒

Flushes explicitly authorized browser sessions before the native host exits; API grants are unaffected.

status_response 🔒

Renders only a declared app-owned component; the framework supplies escaped nonsecret values.

take_pending 🔒

Consumes consent only in its initiating scope/session; another actor cannot invalidate it.

vault 🔒

Resolves an external vault beside runtime state, refusing app installation footprints.