Chris0Jeky
diff --git a/‎.github/workflows/reusable-container-images.yml‎
Lines changed: 1 addition & 1 deletion b/‎.github/workflows/reusable-container-images.yml‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎backend/src/Taskdeck.Api/Controllers/ConnectorProvidersController.cs‎
Lines changed: 181 additions & 0 deletions b/‎backend/src/Taskdeck.Api/Controllers/ConnectorProvidersController.cs‎
Lines changed: 181 additions & 0 deletions
diff --git a/‎backend/src/Taskdeck.Api/Extensions/ApplicationServiceRegistration.cs‎
Lines changed: 5 additions & 0 deletions b/‎backend/src/Taskdeck.Api/Extensions/ApplicationServiceRegistration.cs‎
Lines changed: 5 additions & 0 deletions
diff --git a/‎backend/src/Taskdeck.Api/appsettings.Development.json‎
Lines changed: 3 additions & 0 deletions b/‎backend/src/Taskdeck.Api/appsettings.Development.json‎
Lines changed: 3 additions & 0 deletions
diff --git a/‎backend/src/Taskdeck.Api/appsettings.json‎
Lines changed: 3 additions & 0 deletions b/‎backend/src/Taskdeck.Api/appsettings.json‎
Lines changed: 3 additions & 0 deletions
diff --git a/‎backend/src/Taskdeck.Application/Connectors/ConnectorCredentialService.cs‎
Lines changed: 127 additions & 0 deletions b/‎backend/src/Taskdeck.Application/Connectors/ConnectorCredentialService.cs‎
Lines changed: 127 additions & 0 deletions
@@ -15,7 +15,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Validate compose baseline
-        run: TASKDECK_JWT_SECRET=ci-placeholder-secret docker compose -f deploy/docker-compose.yml --profile baseline config > /tmp/taskdeck-compose.resolved.yml
+        run: TASKDECK_JWT_SECRET=ci-placeholder-secret TASKDECK_CONNECTORS_ENCRYPTION_KEY=ci-placeholder-key docker compose -f deploy/docker-compose.yml --profile baseline config > /tmp/taskdeck-compose.resolved.yml
 
       - name: Build backend container image
         run: docker build -f deploy/docker/backend.Dockerfile -t taskdeck-api:ci .
 
@@ -0,0 +1,181 @@
+using System.ComponentModel.DataAnnotations;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Taskdeck.Api.Contracts;
+using Taskdeck.Api.Extensions;
+using Taskdeck.Application.Connectors;
+using Taskdeck.Application.Interfaces;
+
+namespace Taskdeck.Api.Controllers;
+
+/// <summary>
+/// Connector provider discovery, health checks, and credential management.
+/// All endpoints require authentication (GP-02).
+/// </summary>
+[ApiController]
+[Authorize]
+[Route("api/connectors")]
+[Produces("application/json")]
+public class ConnectorProvidersController : AuthenticatedControllerBase
+{
+    private readonly IConnectorProviderRegistry _providerRegistry;
+    private readonly ConnectorExecutionService _executionService;
+    private readonly IConnectorCredentialService _credentialService;
+
+    public ConnectorProvidersController(
+        IConnectorProviderRegistry providerRegistry,
+        ConnectorExecutionService executionService,
+        IConnectorCredentialService credentialService,
+        IUserContext userContext)
+        : base(userContext)
+    {
+        _providerRegistry = providerRegistry;
+        _executionService = executionService;
+        _credentialService = credentialService;
+    }
+
+    /// <summary>
+    /// List all available connector providers.
+    /// </summary>
+    /// <response code="200">Providers listed.</response>
+    /// <response code="401">Authentication required.</response>
+    [HttpGet("providers")]
+    [ProducesResponseType(typeof(IReadOnlyList<ConnectorProviderSummaryDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ApiErrorResponse), StatusCodes.Status401Unauthorized)]
+    public async Task<IActionResult> ListProviders(CancellationToken cancellationToken)
+    {
+        if (!TryGetCurrentUserId(out _, out var errorResult))
+            return errorResult!;
+
+        var providers = _providerRegistry.GetAll();
+        var summaries = new List<ConnectorProviderSummaryDto>();
+
+        foreach (var provider in providers)
+        {
+            var capabilities = await provider.GetCapabilitiesAsync(cancellationToken);
+            summaries.Add(new ConnectorProviderSummaryDto(
+                provider.ProviderId,
+                capabilities.DisplayName,
+                provider.ConnectorType,
+                provider.Direction,
+                capabilities.Description));
+        }
+
+        return Ok(summaries);
+    }
+
+    /// <summary>
+    /// Check the health of a specific connector provider.
+    /// </summary>
+    /// <param name="providerId">The provider identifier.</param>
+    /// <response code="200">Health check result.</response>
+    /// <response code="401">Authentication required.</response>
+    /// <response code="404">Provider not found.</response>
+    [HttpGet("providers/{providerId}/health")]
+    [ProducesResponseType(typeof(ConnectorProviderHealthDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ApiErrorResponse), StatusCodes.Status401Unauthorized)]
+    [ProducesResponseType(typeof(ApiErrorResponse), StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> CheckProviderHealth(
+        [StringLength(100, MinimumLength = 1)] string providerId,
+        CancellationToken cancellationToken)
+    {
+        if (!TryGetCurrentUserId(out _, out var errorResult))
+            return errorResult!;
+
+        if (string.IsNullOrWhiteSpace(providerId) || providerId.Length > 100)
+        {
+            return BadRequest(new ApiErrorResponse(
+                "ValidationError",
+                "Provider ID must be between 1 and 100 characters."));
+        }
+
+        var result = await _executionService.CheckProviderHealthAsync(providerId, cancellationToken);
+
+        if (!result.IsSuccess)
+            return result.ToErrorActionResult();
+
+        var health = result.Value;
+        return Ok(new ConnectorProviderHealthDto(
+            providerId,
+            health.Status,
+            health.Message,
+            health.CheckedAt));
+    }
+
+    /// <summary>
+    /// Store credentials for a connector instance.
+    /// The plaintext value is encrypted before storage.
+    /// </summary>
+    /// <param name="connectorId">The connector instance ID.</param>
+    /// <param name="dto">The credential to store.</param>
+    /// <response code="201">Credential stored.</response>
+    /// <response code="400">Invalid credential data.</response>
+    /// <response code="401">Authentication required.</response>
+    /// <response code="404">Connector not found.</response>
+    [HttpPost("{connectorId}/credentials")]
+    [ProducesResponseType(typeof(ConnectorCredentialDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(typeof(ApiErrorResponse), StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(typeof(ApiErrorResponse), StatusCodes.Status401Unauthorized)]
+    [ProducesResponseType(typeof(ApiErrorResponse), StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> StoreCredential(
+        Guid connectorId,
+        [FromBody] StoreConnectorCredentialDto dto)
+    {
+        if (!TryGetCurrentUserId(out var userId, out var errorResult))
+            return errorResult!;
+
+        if (string.IsNullOrWhiteSpace(dto.Label))
+        {
+            return BadRequest(new ApiErrorResponse("ValidationError", "Credential label must not be empty."));
+        }
+
+        if (dto.Label.Trim().Length > 100)
+        {
+            return BadRequest(new ApiErrorResponse(
+                "ValidationError",
+                "Credential label cannot exceed 100 characters."));
+        }
+
+        if (string.IsNullOrWhiteSpace(dto.Value))
+        {
+            return BadRequest(new ApiErrorResponse("ValidationError", "Credential value must not be empty."));
+        }
+
+        var result = await _credentialService.StoreCredentialAsync(
+            connectorId,
+            userId,
+            dto.AuthMethod,
+            dto.Label,
+            dto.Value,
+            dto.ExpiresAt);
+
+        if (!result.IsSuccess)
+            return result.ToErrorActionResult();
+
+        return StatusCode(StatusCodes.Status201Created, result.Value);
+    }
+
+    /// <summary>
+    /// Remove credentials for a connector instance.
+    /// </summary>
+    /// <param name="connectorId">The connector instance ID.</param>
+    /// <response code="204">Credential removed.</response>
+    /// <response code="401">Authentication required.</response>
+    /// <response code="404">Credential not found.</response>
+    [HttpDelete("{connectorId}/credentials")]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(typeof(ApiErrorResponse), StatusCodes.Status401Unauthorized)]
+    [ProducesResponseType(typeof(ApiErrorResponse), StatusCodes.Status404NotFound)]
+    public async Task<IActionResult> DeleteCredential(Guid connectorId)
+    {
+        if (!TryGetCurrentUserId(out var userId, out var errorResult))
+            return errorResult!;
+
+        var result = await _credentialService.DeleteCredentialAsync(connectorId, userId);
+
+        if (!result.IsSuccess)
+            return result.ToErrorActionResult();
+
+        return NoContent();
+    }
+}
@@ -1,6 +1,7 @@
 using Taskdeck.Api.Health;
 using Taskdeck.Api.Realtime;
 using Taskdeck.Api.Services;
+using Taskdeck.Application.Connectors;
 using Taskdeck.Application.Interfaces;
 using Taskdeck.Application.Services;
 using Taskdeck.Application.Services.Tools;
@@ -86,6 +87,10 @@ public static IServiceCollection AddApplicationServices(this IServiceCollection
         services.AddSingleton<IBoardPresenceTracker, InMemoryBoardPresenceTracker>();
         services.AddSingleton<RedisBackplaneHealthCheck>();
 
+        // Connector services (provider registration is in Infrastructure DI)
+        services.AddScoped<ConnectorExecutionService>();
+        services.AddScoped<IConnectorCredentialService, ConnectorCredentialService>();
+
         // Agent tool registry (singleton — populated once at startup, read concurrently)
         var toolRegistry = new TaskdeckToolRegistry();
         toolRegistry.RegisterTool(InboxTriageAssistant.GetToolDefinition());
 
@@ -10,6 +10,9 @@
     "Audience": "TaskdeckUsers",
     "ExpirationMinutes": 1440
   },
+  "Connectors": {
+    "EncryptionKey": "MqoG//XUKrOaxMUDf4RXDFGjPIqaX1XMLh9n3YG1qqc="
+  },
   "DevelopmentSandbox": {
     "Enabled": false
   },
 
@@ -107,6 +107,9 @@
     "ClientId": "",
     "ClientSecret": ""
   },
+  "Connectors": {
+    "EncryptionKey": ""
+  },
   "AllowedHosts": "*",
   "ConnectionStrings": {
     "DefaultConnection": "Data Source=taskdeck.db"
 
@@ -0,0 +1,127 @@
+using Taskdeck.Application.Interfaces;
+using Taskdeck.Domain.Common;
+using Taskdeck.Domain.Connectors;
+using Taskdeck.Domain.Entities;
+using Taskdeck.Domain.Exceptions;
+
+namespace Taskdeck.Application.Connectors;
+
+public sealed class ConnectorCredentialService : IConnectorCredentialService
+{
+    private readonly IConnectorCredentialRepository _credentialRepository;
+    private readonly IIntegrationConnectorRepository _connectorRepository;
+    private readonly ICredentialEncryptionService _encryptionService;
+    private readonly IUnitOfWork _unitOfWork;
+
+    public ConnectorCredentialService(
+        IConnectorCredentialRepository credentialRepository,
+        IIntegrationConnectorRepository connectorRepository,
+        ICredentialEncryptionService encryptionService,
+        IUnitOfWork unitOfWork)
+    {
+        _credentialRepository = credentialRepository;
+        _connectorRepository = connectorRepository;
+        _encryptionService = encryptionService;
+        _unitOfWork = unitOfWork;
+    }
+
+    public async Task<Result<ConnectorCredentialDto>> StoreCredentialAsync(
+        Guid connectorId,
+        Guid userId,
+        ConnectorAuthMethod authMethod,
+        string label,
+        string plaintextValue,
+        DateTimeOffset? expiresAt = null,
+        CancellationToken cancellationToken = default)
+    {
+        // Verify connector ownership
+        var connector = await _connectorRepository.GetByIdForUserAsync(connectorId, userId, cancellationToken);
+        if (connector == null)
+            return Result.Failure<ConnectorCredentialDto>(ErrorCodes.NotFound, "Connector not found.");
+
+        // Remove any existing credential for this connector
+        await _credentialRepository.DeleteByConnectorIdAsync(connectorId, userId, cancellationToken);
+
+        try
+        {
+            var encryptedValue = _encryptionService.Encrypt(plaintextValue);
+            var credential = new ConnectorCredential(
+                connectorId,
+                userId,
+                authMethod,
+                label,
+                encryptedValue,
+                expiresAt);
+
+            await _credentialRepository.AddAsync(credential, cancellationToken);
+            await _unitOfWork.SaveChangesAsync(cancellationToken);
+
+            return Result.Success(MapToDto(credential));
+        }
+        catch (DomainException ex)
+        {
+            return Result.Failure<ConnectorCredentialDto>(ex.ErrorCode, ex.Message);
+        }
+        catch (System.Security.Cryptography.CryptographicException)
+        {
+            return Result.Failure<ConnectorCredentialDto>(
+                ErrorCodes.UnexpectedError,
+                "Failed to encrypt credential. The encryption key may be invalid.");
+        }
+        catch (Exception) when (cancellationToken.IsCancellationRequested)
+        {
+            throw; // Propagate cancellation
+        }
+        catch (Exception)
+        {
+            return Result.Failure<ConnectorCredentialDto>(
+                ErrorCodes.UnexpectedError,
+                "An unexpected error occurred while storing the credential.");
+        }
+    }
+
+    public async Task<Result<ConnectorCredentialDto>> GetCredentialAsync(
+        Guid connectorId,
+        Guid userId,
+        CancellationToken cancellationToken = default)
+    {
+        var credential = await _credentialRepository.GetByConnectorIdForUserAsync(
+            connectorId, userId, cancellationToken);
+
+        if (credential == null)
+            return Result.Failure<ConnectorCredentialDto>(ErrorCodes.NotFound, "Credential not found.");
+
+        return Result.Success(MapToDto(credential));
+    }
+
+    public async Task<Result> DeleteCredentialAsync(
+        Guid connectorId,
+        Guid userId,
+        CancellationToken cancellationToken = default)
+    {
+        var credential = await _credentialRepository.GetByConnectorIdForUserAsync(
+            connectorId, userId, cancellationToken);
+
+        if (credential == null)
+            return Result.Failure(ErrorCodes.NotFound, "Credential not found.");
+
+        await _credentialRepository.DeleteAsync(credential, cancellationToken);
+        await _unitOfWork.SaveChangesAsync(cancellationToken);
+
+        return Result.Success();
+    }
+
+    private static ConnectorCredentialDto MapToDto(ConnectorCredential credential)
+    {
+        return new ConnectorCredentialDto(
+            credential.Id,
+            credential.ConnectorId,
+            credential.AuthMethod,
+            credential.Label,
+            HasCredential: !string.IsNullOrEmpty(credential.EncryptedValue),
+            credential.RotatedAt,
+            credential.ExpiresAt,
+            credential.IsExpired,
+            credential.CreatedAt);
+    }
+}