SILVER
/
NODEDC_DESIGN_GUIDELINE
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
NODEDC_DESIGN_GUIDELINE/docs/FOUNDRY_DATA_PRODUCT_BINDIN...

2.1 KiB
Raw Blame History

Foundry Data Product bindings

NDC Foundry Binding is a deploy/control-plane operation. Realtime facts do not pass through the node: Foundry persists an approved page-slot binding and its same-origin BFF reads snapshot + patch from External Data Plane.

Private workload API

GET  /internal/foundry/v1/data-products
POST /internal/foundry/v1/data-product-bindings
Authorization: Bearer ndc_fndbg_<opaque capability>

The POST body is nodedc.foundry.binding-upsert/v1. It contains only application, page, binding, Data Product projection and a stable idempotency key. Provider, tenant, connection, endpoint, URL, raw payload and credentials are rejected.

This credential is not a Foundry MCP fnd1.* capability. MCP capabilities are short-lived interactive grants for AI Workspace. It is also not NODEDC_INTERNAL_ACCESS_TOKEN, a browser session, or an EDP writer/reader grant.

Workload grant

The opaque value never enters a Foundry env file or application manifest. Foundry hashes it with SHA-256 and resolves a root-owned, non-writable record from NODEDC_FOUNDRY_BINDING_GRANTS_DIR on every request. Removing or replacing the record therefore revokes or rotates access immediately.

A nodedc.module-foundry.binding-grant.v1 record fixes:

  • expiry and actions (catalog.read, map-data-product.upsert);
  • actor and owner used by the existing replay-safe Foundry write path;
  • exact allowlisted tuples of application, page, binding, slot, Data Product, semantic types and field projection.

No authorization claim is accepted from request headers or workflow data.

Before persisting a binding, Foundry verifies that the target-specific EDP reader grant exists, is active, permits the selected product and exposes a snapshot+patch product. The reader grant filename remains sha256(applicationId/pageId/bindingId). If it is not ready, POST fails with 409 data_product_reader_grant_not_ready; an unusable visual binding is never saved.

The canonical Map entity-stream slot is points. Other templates may define their own typed slots, but the workload grant must name them explicitly.