- Shipped
- 8 พฤศจิกายน 2569 เวลา 05:10 UTC
- Author
- Kamo
- Commit
- 4a6cd1d
Lender-side asset and income orders ride the borrower's own portal Connection, but nothing ever wrote one a vendor could use. A borrower-link SPI (one bean per vendor, chosen by the org's configured vendorKey) now opens the vendor's own widget and records the consent only once the vendor confirms it: - Plaid: /link/token/create with products [assets]; /item/public_token/exchange stores the item id and the access token as **************** ciphertext> (no cipher, no save). - Finicity: creates (or reuses) the borrower's customer, generates the Connect URL and records the customer id; CONNECTED only when the customer's accounts are really there. - Truv: creates the user and an income bridge token; /v1/link-access-tokens/ stores the link id and the encrypted access token. Rows use the vendor's locked VendorTypeBridge peer, so mlos-vendor-service's BorrowerConsentLookup finds them; a newer link retires the borrower's earlier one. integrations-status says portalLink. A browser can no longer mark a real vendor connection CONNECTED (only the demo STUB rail).