feat: provider connection details pages

src/authsome/auth/utils.py

@@ -137,12 +137,27 @@ def required_inputs(  # noqa: PLR0913
 
     if flow_type == FlowType.PKCE and (provider_config_only or not flow_client_id):
         fields.append(InputField(name="client_id", label="Client ID", secret=False, default=flow_client_id or ""))
-        fields.append(InputField(name="client_secret", label="Client Secret", secret=True, default=""))
+        fields.append(
+            InputField(
+                name="client_secret",
+                label="Client Secret",
+                secret=True,
+                default=client_record.client_secret if provider_config_only and client_record else "",
+            )
+        )
     elif flow_type == FlowType.DEVICE_CODE and (provider_config_only or not flow_client_id):
         fields.append(InputField(name="client_id", label="Client ID", secret=False, default=flow_client_id or ""))
-        fields.append(InputField(name="client_secret", label="Client Secret (Optional)", secret=True, default=""))
+        fields.append(
+            InputField(
+                name="client_secret",
+                label="Client Secret (Optional)",
+                secret=True,
+                default=client_record.client_secret if provider_config_only and client_record else "",
+            )
+        )
 
     needs_scopes = flow_type in (FlowType.PKCE, FlowType.DEVICE_CODE, FlowType.DCR_PKCE)
+
     if needs_scopes and scopes is None and persisted_scopes is None:
         default_scopes = ",".join(provider.oauth.scopes) if provider.oauth and provider.oauth.scopes else ""
         fields.append(

src/authsome/server/credential_service.py

@@ -226,6 +226,21 @@ async def get_connection(
             )
         return record
 
+    async def list_connection_records(self, provider: str) -> list[ConnectionRecord]:
+        """Return stored connection records for a provider in this service's vault."""
+        keys = await self._credentials.list_connection_keys()
+        records: list[ConnectionRecord] = []
+        for key in keys:
+            parts = parse_store_key(key)
+            if parts.record_type != "connection" or not parts.provider or not parts.connection:
+                continue
+            if parts.provider != provider:
+                continue
+            record = await self._credentials.get_connection(parts.provider, parts.connection)
+            if record is not None:
+                records.append(record)
+        return records
+
     async def resolve_connection_name(self, provider: str, connection: str | None = None) -> str:
         """Resolve an optional connection name to the provider default."""
         if connection:
@@ -354,7 +369,17 @@ async def get_required_inputs(
             client_record=client_record,
             scopes=scopes,
             base_url=base_url,
-            provider_config_only=bool(session.payload.get("provider_config_only")),
+        )
+
+    async def get_provider_configuration_inputs(self, provider: str) -> list[InputField]:
+        """Return provider-level configuration fields for admin management UI."""
+        definition = await self.get_provider(provider)
+        client_record = await self._credentials.get_provider_client(provider)
+        return required_inputs(
+            provider=definition,
+            flow_type=definition.flow,
+            client_record=client_record,
+            provider_config_only=True,
         )
 
     async def save_inputs(self, session: AuthSession, inputs: dict[str, str]) -> None:

src/authsome/server/routes/_deps.py

@@ -95,14 +95,22 @@ async def get_auth_service(
     return _build_service(request, resolved)
 
 
-async def require_auth_service(
+async def require_auth_service(  # noqa: PLR0913
     request: Request,
     *,
     identity: str | None = None,
     principal_id: str | None = None,
+    acting_auth: CredentialService | None = None,
+    require_admin_for_other_principal: bool = False,
     status_code: int = 404,
     detail: str = "Authentication context not found",
 ) -> CredentialService:
+    if acting_auth is not None and principal_id is not None:
+        if principal_id == acting_auth.principal_id:
+            return acting_auth
+        if require_admin_for_other_principal and acting_auth.principal_role != PrincipalRole.ADMIN:
+            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin role required")
+
     auth = await get_auth_service(request, identity=identity, principal_id=principal_id)
     if auth is None:
         raise HTTPException(status_code=status_code, detail=detail)

src/authsome/server/routes/auth.py

@@ -238,9 +238,6 @@ async def get_session_input(
     callback_url = None
     if definition.auth_type == AuthType.OAUTH2:
         callback_url = build_callback_url(server_base_url)
-    warning_message = None
-    if session.payload.get("provider_config_only") and session.payload.get("existing_provider_client"):
-        warning_message = "Changing these credentials will revoke existing connections for this provider."
 
     return {
         "session_id": session.session_id,
@@ -249,7 +246,7 @@ async def get_session_input(
         "docs_url": definition.docs_url,
         "fields": fields,
         "callback_url": callback_url,
-        "warning": warning_message,
+        "warning": None,
     }
 
 
@@ -365,19 +362,6 @@ async def _submit_session_input(  # noqa: PLR0911
     form = await request.form()
     inputs = {key: str(value) for key, value in form.items()}
 
-    if session.payload.get("provider_config_only"):
-        all_vaults = await request.app.state.store.vaults.list_all()
-        vault_ids = [vault.vault_id for vault in all_vaults] or ([auth.vault_id] if auth.vault_id else [])
-        await auth.update_provider_configuration(session.provider, inputs, vault_ids=vault_ids)
-        session.state = AuthSessionStatus.COMPLETED
-        session.status_message = "Provider configuration updated"
-        await sessions.save(session)
-        if return_url := session.payload.get("return_url"):
-            return RedirectResponse(str(return_url), status_code=status.HTTP_303_SEE_OTHER)
-        return RedirectResponse(
-            build_auth_success_url(server_base_url, session.session_id), status_code=status.HTTP_303_SEE_OTHER
-        )
-
     await auth.save_inputs(session, inputs)
 
     flow = FlowType(session.flow_type)

src/authsome/server/routes/connections.py

@@ -1,21 +1,62 @@
 """Connection routes."""
 
-from fastapi import APIRouter, Depends
+from fastapi import APIRouter, Depends, HTTPException, Request, status
 
 from authsome.auth.models.enums import ExportFormat
+from authsome.identity.principal import PrincipalRole
 from authsome.server.analytics import capture_event
 from authsome.server.credential_service import CredentialService
 from authsome.server.routes._deps import (
-    get_admin_auth_service,
     get_daemon_or_browser_auth_service,
     get_protected_auth_service,
     get_vault_registry,
+    require_auth_service,
 )
+from authsome.server.schemas import ConnectionDetailResponse, ConnectionSecretsResponse
 from authsome.server.store.repositories import VaultRegistry
 
 router = APIRouter(tags=["connections"])
 
 
+def _actor(auth: CredentialService) -> str:
+    return auth.identity or auth.principal_id or "account-ui"
+
+
+async def _connection_detail(
+    auth: CredentialService,
+    provider: str,
+    connection: str,
+    *,
+    can_set_default: bool,
+) -> ConnectionDetailResponse:
+    definition = await auth.get_provider(provider)
+    record = await auth.get_connection(provider, connection)
+    return ConnectionDetailResponse(
+        provider=record.provider,
+        provider_display_name=definition.display_name,
+        connection_name=record.connection_name,
+        principal_id=record.principal_id,
+        identity=record.identity,
+        vault_id=record.vault_id,
+        status=record.status.value,
+        auth_type=record.auth_type.value,
+        base_url=record.base_url,
+        api_url=record.api_url,
+        scopes=list(record.scopes or []),
+        token_type=record.token_type,
+        obtained_at=record.obtained_at,
+        expires_at=record.expires_at,
+        account=record.account.model_dump(mode="json") if record.account else None,
+        secrets=ConnectionSecretsResponse(
+            access_token=record.access_token,
+            refresh_token=record.refresh_token,
+            api_key=record.api_key,
+            credentials=dict(record.credentials or {}),
+        ),
+        can_set_default=can_set_default,
+    )
+
+
 @router.get("/connections")
 async def list_connections(auth: CredentialService = Depends(get_daemon_or_browser_auth_service)):
     by_source = await auth.list_providers_by_source()
@@ -33,16 +74,53 @@ async def get_connection(provider: str, connection: str, auth: CredentialService
     return (await auth.get_connection(provider, connection)).model_dump(mode="json")
 
 
+@router.get("/connections/{provider}/{connection}/detail", response_model=ConnectionDetailResponse)
+async def get_connection_detail(
+    provider: str,
+    connection: str,
+    request: Request,
+    principal: str | None = None,
+    auth: CredentialService = Depends(get_daemon_or_browser_auth_service),
+):
+    target = await require_auth_service(
+        request,
+        principal_id=principal or auth.principal_id,
+        acting_auth=auth,
+        require_admin_for_other_principal=True,
+        detail="Principal not found",
+    )
+    return await _connection_detail(
+        target,
+        provider,
+        connection,
+        can_set_default=target.principal_id == auth.principal_id,
+    )
+
+
 @router.post("/connections/{provider}/{connection}/logout")
-async def logout(provider: str, connection: str, auth: CredentialService = Depends(get_protected_auth_service)):
-    await auth.logout(provider, connection)
+async def logout(
+    provider: str,
+    connection: str,
+    request: Request,
+    principal: str | None = None,
+    auth: CredentialService = Depends(get_daemon_or_browser_auth_service),
+):
+    target = await require_auth_service(
+        request,
+        principal_id=principal or auth.principal_id,
+        acting_auth=auth,
+        require_admin_for_other_principal=True,
+        detail="Principal not found",
+    )
+    await target.logout(provider, connection)
     capture_event(
-        auth.require_identity(),
+        _actor(auth),
         "connection logout",
         {
             "provider": provider,
             "connection": connection,
-            "principal_id": auth.principal_id,
+            "principal_id": target.principal_id,
+            "requested_by_principal_id": auth.principal_id,
         },
     )
     return {"status": "ok"}
@@ -51,14 +129,16 @@ async def logout(provider: str, connection: str, auth: CredentialService = Depen
 @router.post("/connections/{provider}/revoke")
 async def revoke(
     provider: str,
-    auth: CredentialService = Depends(get_admin_auth_service),
+    auth: CredentialService = Depends(get_daemon_or_browser_auth_service),
     vault_registry: VaultRegistry = Depends(get_vault_registry),
 ):
+    if auth.principal_role != PrincipalRole.ADMIN:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin role required")
     all_vaults = await vault_registry.list_all()
     vault_ids: list[str] = [v.vault_id for v in all_vaults] or ([auth.vault_id] if auth.vault_id else [])
     await auth.revoke(provider, vault_ids=vault_ids)
     capture_event(
-        auth.require_identity(),
+        _actor(auth),
         "connection revoked",
         {
             "provider": provider,
@@ -72,7 +152,7 @@ async def revoke(
 async def set_default_connection(
     provider: str,
     connection: str,
-    auth: CredentialService = Depends(get_protected_auth_service),
+    auth: CredentialService = Depends(get_daemon_or_browser_auth_service),
 ):
     await auth.set_default_connection(provider, connection)
     return {"status": "ok", "provider": provider, "default_connection": connection}