Integrations & storage¶
Users can connect their third-party accounts and manage files directly from the app. The platform also has its own SFTP storage (Gerege Space).
UI: /me/integrations.
Supported providers¶
| Provider | What it does |
|---|---|
| Google Drive | List, read and upload files |
| Google Meet | Create meeting spaces |
| Dropbox | List, preview and upload files |
| Google (login) | The sign-in link — unlinked separately |
Token storage¶
User OAuth tokens are stored in the user_integrations table encrypted with
AES-256-GCM. The key is INTEGRATION_ENC_KEY (≥16 bytes).
Never rotate INTEGRATION_ENC_KEY
The same key encrypts integration tokens and super-admin TOTP secrets. Rotating it breaks both, irrecoverably.
The table is RLS-protected: users only see their own connections.
API¶
| Endpoint | What |
|---|---|
GET /v1/integrations |
My connections |
POST /v1/integrations |
Create a connection (from the callback) |
GET /v1/integrations/{provider}/token |
Fetch the token for internal use |
DELETE /v1/integrations/{provider} |
Disconnect |
BFF routes add the per-provider operations:
/api/integrations/{provider}/connect start OAuth
/api/integrations/{provider}/callback exchange the code
/api/integrations/{provider}/disconnect disconnect
/api/integrations/google-drive/files list files
/api/integrations/google-drive/files/{id} read a file
/api/integrations/google-drive/upload upload
/api/integrations/google-meet/create-space create a meeting space
/api/integrations/dropbox/{files,preview,upload}
/api/integrations/google-login/disconnect unlink sign-in
Gerege Space (SFTP)¶
The platform's own file storage, independent of any third party.
| Endpoint | What |
|---|---|
GET /v1/gspace/ |
List files |
GET /v1/gspace/download |
Download |
POST /v1/gspace/upload |
Upload |
DELETE /v1/gspace/ |
Delete |
| Setting | Value |
|---|---|
GSPACE_HOST · GSPACE_PORT · GSPACE_USER · GSPACE_PASSWORD |
SFTP connection |
GSPACE_HOST_KEY |
Host key pin — protects against MITM |
GSPACE_BASE_PATH |
Base directory |
GSPACE_QUOTA_BYTES |
Per-user quota (default ~2 MB) |
Writes are rate limited to ~30/min. Each user's directory is isolated.
Always pin the host key
Without GSPACE_HOST_KEY the SFTP connection does not verify the host key,
which makes a man-in-the-middle possible.
Assets and images¶
The assets module manages signatures, stamps and Latin names. Images live in
external storage; the URLs live in the database. See
Document signing.
External lookup clients¶
The platform queries these external systems:
| Client | Configuration | What |
|---|---|---|
| Gerege Verify | VERIFY_API_BASE · VERIFY_API_KEY · VERIFY_CHANNEL |
Verifying citizens / organisations |
| XYP | XYP_API_BASE · XYP_CLIENT_ID · XYP_CLIENT_SECRET |
State registry lookups |
| Gerege Core | CORE_API_BASE · CORE_API_TOKEN |
USER FIND / ORG FIND |
| eID Mongolia | EID_* |
Authentication and signing |
| Gemini | GEMINI_* |
AI assistant |
With VERIFY_OPTIONAL=true the organisation-creation flow continues even when
Verify is unavailable (development).