The External interaction docs page is an overview; it does not explain the URL interaction mechanism in depth. This adds a specialized, illustrated deep-dive page, docs/interaction-internals.md, covering how a public token-bearing URL drives a parked step and why it is safe.

Contents:

  • The request lifecycle (a sequence diagram through the dispatcher, token, resolver, plugin, gateway, engine).
  • Anatomy of the capability token, as an SVG illustration: the instance/token/expiry/signature fields and the HMAC keyed by the site private key + hash salt.
  • Minting and validating (the sign() and open() paths, hash_equals, expiry).
  • The dispatcher decision tree, link scope (instance vs branch) as an SVG, and the blast radius.
  • A threat-by-threat security table.
  • The one-plugin, two-doorways model (bearer vs identity) and the continuation-handle resolver chain.
  • The Webform integration (resume-on-submit binding and chaining).
  • Reference tables for routes and key classes.

Static inline SVG plus Mermaid diagrams (no JavaScript beyond the theme's Mermaid), added to the nav after External interaction. Verified with mkdocs build --strict.

Issue fork orchestra-3607921

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

mably created an issue. See original summary.

mably’s picture

Status: Active » Needs review

  • mably committed b42fe9cd on 1.x
    task: #3607921 Docs: add a detailed, illustrated external-interaction...
mably’s picture

Status: Needs review » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.