aeat.adapters.outbound.aeat.auth._clave_permanente_metadata module

Cl@ve Permanente persisted-session metadata records.

ClavePermanenteAuthProvider stores ClavePermanenteSessionMetadata inside the encrypted PersistedBrowserSession metadata mapping. The record binds the Playwright storage state to the operator identity, post-auth landing URL, and resume deadline observed during the headless DNI/NIE + password login flow.

Application callers later narrow this provider-owned shape to the common PersistedAuthSession reuse contract.

See also

ClavePermanenteAuthProvider

Provider that writes and reloads this metadata beside browser state.

ClavePermanenteSessionDetail

Public session detail projected from this encrypted metadata record.

PersistedBrowserSession

Encrypted browser-session envelope whose metadata mapping stores this provider-owned record.

PersistedAuthSession

Application reuse contract that receives the narrowed provider detail.

AEAT_CLAVE_PERMANENTE_METADATA_SCHEMA_VERSION: Final[int]

Schema version for Cl@ve Permanente metadata records.

class ClavePermanenteSessionMetadata(**data)[source]

Bases: BaseModel

Provider-owned metadata stored with encrypted Cl@ve Permanente storage state.

provider_kind keeps the encrypted object distinguishable from certificate and Cl@ve Móvil metadata. storage_state_sha256 lets resume paths reject stale or mismatched browser state, while landing_url lets live probes verify an already-authenticated page without re-entering AEAT’s Cl@ve selector. The same operational fields are projected into ClavePermanenteSessionDetail when a session is rebuilt. Unlike Cl@ve Móvil, no verification code or non-QR-fallback flag applies — the login form carries no phone-approval state.

Parameters:
schema_version: int
provider_kind: AuthProviderKind
identity_nif: str
authenticated_at: datetime
idle_deadline: datetime
storage_state_sha256: str
landing_url: str | None