Record which resources a control plane owns

backend/cmd/server/main.go

@@ -234,12 +234,16 @@ func createHTTPServer(ctx context.Context, logger *log.Logger, cfg *config.Confi
 	securityMiddleware := createSecurityMiddleware(ctx, logger, mux, jwtService, revocationEnforcer)
 
 	// Build the middleware chain with proper execution order.
-	// Request flow: CorrelationID (outermost) -> SecurityHeaders -> AccessLog -> Security -> Route Handler (innermost)
+	// Request flow: CorrelationID (outermost) -> DeploymentID -> SecurityHeaders -> AccessLog ->
+	// Security -> Route Handler (innermost)
 	// Note: Middlewares are wrapped in reverse order - the last added will execute first.
 	// The Gate and Console frontend paths are always excluded from the access log to keep it
 	// focused on API traffic. Additional prefixes can be excluded via log.access.exclude_paths.
 	handler := log.AccessLogHandler(logger, accessLogExcludePaths(cfg.Log.Access.ExcludePaths), securityMiddleware)
 	handler = middleware.SecurityHeadersMiddleware()(handler)
+	// Outside the security layer, so that every request carries the deployment id it acts for by the
+	// time any store is reached.
+	handler = middleware.DeploymentIDMiddleware(handler)
 	handler = middleware.CorrelationIDMiddleware(handler)
 
 	// Build the server address using hostname and port from the configurations.

backend/cmd/server/servicemanager.go

@@ -86,6 +86,7 @@ import (
 	"github.com/thunder-id/thunderid/internal/system/kmprovider"
 	"github.com/thunder-id/thunderid/internal/system/kmprovider/defaultkm/pki"
 	"github.com/thunder-id/thunderid/internal/system/log"
+	"github.com/thunder-id/thunderid/internal/system/managedresource"
 	"github.com/thunder-id/thunderid/internal/system/mcp"
 	"github.com/thunder-id/thunderid/internal/system/observability"
 	"github.com/thunder-id/thunderid/internal/system/resourcedependency"
@@ -95,6 +96,7 @@ import (
 	"github.com/thunder-id/thunderid/internal/user"
 	"github.com/thunder-id/thunderid/internal/vc/credential"
 	"github.com/thunder-id/thunderid/internal/vc/presentation"
+	engineconfig "github.com/thunder-id/thunderid/pkg/thunderidengine/config"
 	"github.com/thunder-id/thunderid/pkg/thunderidengine/providers"
 )
 
@@ -125,6 +127,11 @@ func registerServices(mux *http.ServeMux, cacheManager cache.CacheManagerInterfa
 	cmodels.SetConfigCryptoProvider(configCryptoSvc)
 
 	runtime := config.GetServerRuntime()
+	// Resources applied from a control plane are recorded as owned by it, and this deployment's
+	// management APIs then refuse to change them. Installed before any consumer package so the first
+	// request is already guarded.
+	initManagedResources(ctx, logger, mux, runtime.Config.Server)
+
 	joseCfg := joseconfig.Config{
 		Issuer:         runtime.Config.JWT.Issuer,
 		ValidityPeriod: runtime.Config.JWT.ValidityPeriod,
@@ -688,3 +695,16 @@ func buildHashConfig() (cryptolib.HashConfig, error) {
 		return cryptolib.HashConfig{}, fmt.Errorf("unrecognized password hashing algorithm %q", cfg.Algorithm)
 	}
 }
+
+// initManagedResources installs the registry that records which resources belong to a control plane.
+// It stays inert unless this deployment is configured as control plane managed, so a standalone
+// server behaves exactly as before.
+func initManagedResources(ctx context.Context, logger *log.Logger, mux *http.ServeMux,
+	cfg engineconfig.ServerConfig) {
+	registry := managedresource.New(cfg.ControlPlaneManaged, cfg.Identifier)
+	managedresource.SetDefault(registry)
+	if registry.Enabled() {
+		logger.Info(ctx, "Resources applied from the control plane are read only on this deployment")
+	}
+	managedresource.RegisterRoutes(mux)
+}

backend/dbscripts/configdb/postgres.sql

@@ -362,3 +362,14 @@ CREATE TABLE "SERVER_CONFIG" (
     UPDATED_AT    TIMESTAMPTZ  DEFAULT NOW(),
     PRIMARY KEY (DEPLOYMENT_ID, NAME)
 );
+
+-- import writes and clears these rows.
+CREATE TABLE "MANAGED_RESOURCE" (
+    DEPLOYMENT_ID VARCHAR(255) NOT NULL,
+    RESOURCE_TYPE VARCHAR(64)  NOT NULL,
+    RESOURCE_ID   VARCHAR(255) NOT NULL,
+    CREATED_AT    TIMESTAMPTZ  DEFAULT NOW(),
+    PRIMARY KEY (DEPLOYMENT_ID, RESOURCE_TYPE, RESOURCE_ID)
+);
+-- Every write is checked against this registry, so the lookup has to be cheap.
+CREATE INDEX idx_managed_resource_deployment ON "MANAGED_RESOURCE" (DEPLOYMENT_ID);

backend/dbscripts/configdb/sqlite.sql

@@ -362,3 +362,14 @@ CREATE TABLE "SERVER_CONFIG" (
     UPDATED_AT    TEXT         DEFAULT (datetime('now')),
     PRIMARY KEY (DEPLOYMENT_ID, NAME)
 );
+
+-- import writes and clears these rows.
+CREATE TABLE "MANAGED_RESOURCE" (
+    DEPLOYMENT_ID VARCHAR(255) NOT NULL,
+    RESOURCE_TYPE VARCHAR(64)  NOT NULL,
+    RESOURCE_ID   VARCHAR(255) NOT NULL,
+    CREATED_AT    TEXT         DEFAULT (datetime('now')),
+    PRIMARY KEY (DEPLOYMENT_ID, RESOURCE_TYPE, RESOURCE_ID)
+);
+-- Every write is checked against this registry, so the lookup has to be cheap.
+CREATE INDEX idx_managed_resource_deployment ON "MANAGED_RESOURCE" (DEPLOYMENT_ID);

backend/internal/entity/credential_reference_test.go

@@ -0,0 +1,158 @@
+/*
+ * Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
+ *
+ * WSO2 LLC. licenses this file to you under the Apache License,
+ * Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package entity
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/thunder-id/thunderid/internal/system/cryptolib"
+	"github.com/thunder-id/thunderid/internal/system/secretresolver"
+)
+
+// serveKVHash stands up a secret provider holding one hash backed secret.
+func serveKVHash(t *testing.T, name string, hash cryptolib.Credential) {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_ = json.NewEncoder(w).Encode(map[string]interface{}{"secrets": map[string]interface{}{
+			name: map[string]interface{}{
+				"kind":      "hash",
+				"value":     hash.Hash,
+				"algorithm": string(hash.Algorithm),
+				"parameters": map[string]interface{}{
+					"salt":       hash.Parameters.Salt,
+					"iterations": hash.Parameters.Iterations,
+					"keySize":    hash.Parameters.KeySize,
+				},
+			},
+		}})
+	}))
+	t.Cleanup(srv.Close)
+
+	previous := secretresolver.Default()
+	r := secretresolver.New(secretresolver.Config{BaseURL: srv.URL})
+	if err := r.LoadAll(t.Context()); err != nil {
+		t.Fatalf("load: %v", err)
+	}
+	secretresolver.SetDefault(r)
+	t.Cleanup(func() { secretresolver.SetDefault(previous) })
+}
+
+// hashOf produces a credential the way the control plane would.
+func hashOf(t *testing.T, plaintext string) cryptolib.Credential {
+	t.Helper()
+	svc, err := cryptolib.Initialize(cryptolib.HashConfig{
+		Algorithm: cryptolib.PBKDF2, SaltSize: 16, Iterations: 1000, KeySize: 32,
+	})
+	if err != nil {
+		t.Fatalf("hash service: %v", err)
+	}
+	cred, err := svc.Generate([]byte(plaintext))
+	if err != nil {
+		t.Fatalf("generate: %v", err)
+	}
+	return cred
+}
+
+func TestCredentialReference_ResolvesAPromotedCredentialFromTheSecretProvider(t *testing.T) {
+	const plaintext = "the-client-secret"
+	hash := hashOf(t, plaintext)
+	serveKVHash(t, "MY_APP_CLIENT_SECRET", hash)
+
+	// The database holds only a reference: the credential itself never reached this deployment's DB.
+	ref, usable := credentialReference(StoredCredential{Value: "secret:MY_APP_CLIENT_SECRET"})
+	if !usable {
+		t.Fatal("a resolvable reference must be usable")
+	}
+	if ref.Hash != hash.Hash || ref.Parameters.Salt != hash.Parameters.Salt {
+		t.Fatalf("the reference should carry the provider's hash and parameters, got %+v", ref)
+	}
+	// The parameters come from wherever the credential was made, not from this server's configuration.
+	if ref.Parameters.Iterations != hash.Parameters.Iterations {
+		t.Fatalf("iterations should come from the provider, got %d", ref.Parameters.Iterations)
+	}
+}
+
+func TestCredentialReference_LeavesANativeCredentialAlone(t *testing.T) {
+	hash := hashOf(t, "created-here")
+
+	// A credential created on this deployment is stored normally and must keep working unchanged.
+	ref, usable := credentialReference(StoredCredential{
+		StorageAlgo:       hash.Algorithm,
+		Value:             hash.Hash,
+		StorageAlgoParams: hash.Parameters,
+	})
+	if !usable || ref.Hash != hash.Hash || ref.Algorithm != hash.Algorithm {
+		t.Fatalf("a stored credential should be used as it stands, got %+v usable=%v", ref, usable)
+	}
+}
+
+func TestCredentialReference_RejectsAnUnresolvableReference(t *testing.T) {
+	serveKVHash(t, "SOMETHING_ELSE", hashOf(t, "x"))
+
+	// An absent secret must reject rather than pass: treating it as a match would let any value in.
+	if _, usable := credentialReference(StoredCredential{Value: "secret:NOT_IN_THE_PROVIDER"}); usable {
+		t.Fatal("an unresolvable reference must not be usable")
+	}
+}
+
+func TestHashPlaintextCredentials_KeepsAReferenceAsItIs(t *testing.T) {
+	const plaintext = "the-client-secret"
+	hash := hashOf(t, plaintext)
+	serveKVHash(t, "MY_APP_CLIENT_SECRET", hash)
+
+	svc := &entityService{hashService: mustHashService(t)}
+	stored, err := svc.hashPlaintextCredentials(json.RawMessage(`{"clientSecret":"secret:MY_APP_CLIENT_SECRET"}`))
+	if err != nil {
+		t.Fatalf("hash credentials: %v", err)
+	}
+
+	var creds map[string][]StoredCredential
+	if err := json.Unmarshal(stored, &creds); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	// Hashing the reference text would store the hash of "secret:..." and reject every authentication.
+	if got := creds["clientSecret"][0].Value; got != "secret:MY_APP_CLIENT_SECRET" {
+		t.Fatalf("the reference should be stored verbatim, got %q", got)
+	}
+
+	// And the reference still resolves to the provider's hash, so the real secret verifies.
+	ref, usable := credentialReference(creds["clientSecret"][0])
+	if !usable {
+		t.Fatal("the stored reference must resolve")
+	}
+	ok, err := mustHashService(t).Verify([]byte(plaintext), ref)
+	if err != nil || !ok {
+		t.Fatalf("the promoted credential should verify, ok=%v err=%v", ok, err)
+	}
+}
+
+// mustHashService builds the hashing this server would be configured with.
+func mustHashService(t *testing.T) cryptolib.HashServiceInterface {
+	t.Helper()
+	svc, err := cryptolib.Initialize(cryptolib.HashConfig{
+		Algorithm: cryptolib.PBKDF2, SaltSize: 16, Iterations: 1000, KeySize: 32,
+	})
+	if err != nil {
+		t.Fatalf("hash service: %v", err)
+	}
+	return svc
+}

backend/internal/entity/service.go

@@ -16,6 +16,7 @@ import (
 	"github.com/thunder-id/thunderid/internal/ou"
 	"github.com/thunder-id/thunderid/internal/system/cryptolib"
 	"github.com/thunder-id/thunderid/internal/system/log"
+	"github.com/thunder-id/thunderid/internal/system/secretresolver"
 	sysutils "github.com/thunder-id/thunderid/internal/system/utils"
 	"github.com/thunder-id/thunderid/pkg/thunderidengine/providers"
 )
@@ -560,14 +561,9 @@ func (s *entityService) verifyCredentials(credentials map[string]interface{},
 		credList := storedCreds[credType]
 		verified := false
 		for _, stored := range credList {
-			ref := cryptolib.Credential{
-				Algorithm: stored.StorageAlgo,
-				Hash:      stored.Value,
-				Parameters: cryptolib.CredParameters{
-					Salt:       stored.StorageAlgoParams.Salt,
-					Iterations: stored.StorageAlgoParams.Iterations,
-					KeySize:    stored.StorageAlgoParams.KeySize,
-				},
+			ref, usable := credentialReference(stored)
+			if !usable {
+				continue
 			}
 			ok, verifyErr := s.hashService.Verify([]byte(credValue), ref)
 			if verifyErr == nil && ok {
@@ -583,6 +579,45 @@ func (s *entityService) verifyCredentials(credentials map[string]interface{},
 	return nil
 }
 
+// credentialReference builds what a presented value is verified against.
+//
+// A credential promoted from a control plane is stored as a reference rather than a hash, because the
+// hash lives in this deployment's secret provider instead of its database. Those are resolved here, so
+// verification is the same comparison either way. A credential created on this deployment is stored
+// normally and is used as it stands.
+//
+// usable is false when a reference cannot be resolved. That is deliberately not treated as a match:
+// an unresolvable credential must reject, not pass.
+func credentialReference(stored StoredCredential) (cryptolib.Credential, bool) {
+	if secretresolver.IsReference(stored.Value) {
+		h, found, err := secretresolver.Default().ResolveHash(context.Background(), stored.Value)
+		if err != nil || !found {
+			return cryptolib.Credential{}, false
+		}
+		return cryptolib.Credential{
+			Algorithm: cryptolib.CredAlgorithm(h.Algorithm),
+			Hash:      h.Value,
+			Parameters: cryptolib.CredParameters{
+				Salt:        h.Salt,
+				Iterations:  h.Iterations,
+				KeySize:     h.KeySize,
+				Memory:      h.Memory,
+				Parallelism: h.Parallelism,
+			},
+		}, true
+	}
+
+	return cryptolib.Credential{
+		Algorithm: stored.StorageAlgo,
+		Hash:      stored.Value,
+		Parameters: cryptolib.CredParameters{
+			Salt:       stored.StorageAlgoParams.Salt,
+			Iterations: stored.StorageAlgoParams.Iterations,
+			KeySize:    stored.StorageAlgoParams.KeySize,
+		},
+	}, true
+}
+
 // UpdateCredentials updates schema-defined credentials (e.g., password) by hashing new
 // plaintext values and merging with existing stored credentials. Payload keys are
 // restricted to fields declared as credentials in the entity's schema.
@@ -1091,6 +1126,14 @@ func (s *entityService) hashPlaintextCredentials(creds json.RawMessage) (json.Ra
 			if v == "" {
 				continue
 			}
+			// A reference is not a credential to hash: the hash it points at lives in this
+			// deployment's secret provider. Hashing it here would store the hash of the reference
+			// text and every authentication would fail, so it is kept as it is and resolved when a
+			// presented value is verified.
+			if secretresolver.IsReference(v) {
+				result[credType] = []StoredCredential{{Value: v}}
+				continue
+			}
 			credHash, err := s.hashService.Generate([]byte(v))
 			if err != nil {
 				return nil, fmt.Errorf("failed to hash credential %q: %w", credType, err)