feat(connectivity): protect connectivity-api with the stack auth issuer

[Dav-14]

Problem

The connectivity-api companion is exposed through the stack gateway at /api/connectivity, but nothing wires its OIDC protection: the module reconciler never sets spec.api.auth on the delegated connectivity.formance.com/Connectivity, so the connectivity operator renders the API pod with AUTH_ENABLED=false. The gateway does not enforce auth per route either (the Secured rule flag is not rendered in the Caddyfile), so on a stack with an Auth module — where ledger and payments self-verify bearer tokens — connectivity-api is the only module API reachable without a token.

Fix

connectivities.Reconcile now resolves the module's protection through the shared auths.GetProtectedConfiguration (the same machinery behind ledger/payments AUTH_ENABLED/AUTH_ISSUER):

• stack has an Auth module → spec.api.auth.issuer is set to the stack auth issuer and spec.api.auth.checkScopes follows the auth.connectivity.check-scopes Setting (platform default: false);
• no Auth module → spec.api.auth is removed and the API keeps running unauthenticated (behind-VPN / in-cluster deployments);
• resolution failure → hard error with an APIAuthResolveFailed condition.

checkScopes is always set explicitly because the connectivity CRD defaults it to true while the platform convention defaults to false. The connectivity CRD models a single trusted issuer, so additional auth.issuers Settings entries are not propagated.

Also adds docs/04-Modules/12-Connectivity.md (the module had no page), covering the module basics and the auth behavior.

Tests

• internal/resources/connectivities/init_test.go:
  • issuer + explicit checkScopes: false wired when the stack has an Auth module (written first, watched fail);
  • checkScopes: true when the auth.connectivity.check-scopes Setting is enabled (written first, watched fail);
  • stale spec.api.auth cleared when the stack has no Auth module (written first, watched fail);
  • hard error + APIAuthResolveFailed condition when the Auth lookup fails (interceptor, added for error-branch coverage).
• Package suite green, coverage 72.1% (baseline 71.9%).
• just pre-commit (tidy, lint, generate, manifests, helm validate, docs, settings catalog) — no generated drift.

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1847ce9e-0715-4336-ba36-6bfdc70c7206

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}