// Settings → MLS Connections — hold the keys for MLS data platforms so the
// v2 listing import has somewhere to plug in the moment credentials arrive.
//
// The whole form is driven by the server's provider registry (GET /api/mls)
// — this file knows nothing about specific platforms, so adding one on the
// server lights it up here automatically.
//
// Secret handling: secret fields are write-only. A saved secret renders as a
// password input with a "saved" placeholder and is never fetched back;
// saving always re-sends the full set of fields for that platform.
const MlsSection = () => {
const [data, setData] = React.useState(null); // GET /api/mls payload
const [open, setOpen] = React.useState(null); // provider id with form expanded
const [form, setForm] = React.useState({}); // field key → value being typed
const [agreed, setAgreed] = React.useState({}); // attestation id → checked
const [busy, setBusy] = React.useState(false);
const [error, setError] = React.useState(null);
const [notice, setNotice] = React.useState(null);
const load = () => api.getMlsProviders().then(setData).catch(err => setError(err.message));
React.useEffect(() => { load(); }, []);
const openForm = (p) => {
// Pre-fill non-secret values so editing doesn't force retyping IDs.
const initial = {};
p.fields.forEach(f => {
if (!f.secret && typeof p.values[f.key] === 'string') initial[f.key] = p.values[f.key];
});
setForm(initial); setAgreed({}); setOpen(p.id); setError(null); setNotice(null);
};
// Server enforces this too (the checkboxes ride along as attestation ids)
// — the UI just refuses to enable Save until everything is confirmed.
const allAgreed = (data?.attestations || []).every(a => agreed[a.id]);
const save = async (p) => {
setBusy(true); setError(null);
try {
const res = await api.saveMlsCredentials(p.id, {
...form,
attestations: Object.keys(agreed).filter(id => agreed[id]),
});
setNotice(res.message); setOpen(null); setForm({}); setAgreed({});
await load();
} catch (err) { setError(err.message); }
finally { setBusy(false); }
};
const remove = async (p) => {
if (!await confirmAction(`Remove the saved ${p.label} credentials?`)) return;
setBusy(true); setError(null);
try {
await api.removeMlsCredentials(p.id);
setNotice(`${p.label} credentials removed.`); setOpen(null);
await load();
} catch (err) { setError(err.message); }
finally { setBusy(false); }
};
if (!data) return
{error || 'Loading…'}
;
return (
When your MLS grants data access, it happens through one of these platforms —
save the keys they issue here and SPEC's listing import can use them.
Keys are encrypted before they're stored and are never shown again once saved.
{!data.crypto_ready && (
{' '}
Credential encryption isn't configured on this server (MLS_CRED_KEY) — saving is disabled.