aeat.adapters.outbound.aeat.auth._session_store module¶

Encrypted persistence for AEAT browser session state.

This module is the concrete adapter behind application.auth._protocols.SessionStoreProtocol. It stores PersistedBrowserSession payloads in adapters.persistence.storage.AEAT_BROWSER_SESSION_NAMESPACE, whose registry entry pins the records to bucket-local SESSION SensitivityClass storage, schema version, process-local custody, and logical-path object-key grammar.

SecureObjectRepository encrypts payload bytes and digests the logical object key at the column boundary, so Playwright cookies, local storage, and provider metadata never appear as plaintext files.

class PersistedBrowserSession(**data)[source]¶

Bases: BaseModel

Encrypted Playwright storage state plus provider-owned metadata.

This is the typed payload stored under adapters.persistence.storage.AEAT_BROWSER_SESSION_NAMESPACE. storage_state carries the payload returned by BrowserContext.storage_state(). metadata remains a provider-owned mapping so certificate auth and Cl@ve Móvil can persist different validated metadata models while exposing the same encrypted envelope to callers.

Parameters:

schema_version (int)
storage_state (PlaywrightStorageState)
metadata (ProviderSessionMetadata)
written_at (datetime)

schema_version: int¶

storage_state: PlaywrightStorageState¶

metadata: ProviderSessionMetadata¶

written_at: datetime¶

property storage_state_sha256: str¶: Return the canonical SHA-256 fingerprint of the storage-state payload.

exists(path)[source]¶

Return whether an encrypted session exists for logical path.

path is the logical storage-state identifier produced by storage_state_paths() or provider-specific helpers, not a plaintext file path to inspect.

Return type:: bool
Parameters:: path (Path)

save(path, *, storage_state, metadata)[source]¶

Persist storage_state and metadata in the browser-session namespace.

The values are wrapped in a PersistedBrowserSession envelope before SecureObjectRepository encrypts the serialized JSON payload. The namespace definition supplies the SESSION SensitivityClass classification and schema version. storage_state/metadata are validated JSON-safe here (mirroring _storage_state_sha256()) so the caller-facing boundary stays the wide Mapping[str, object] shape BrowserContextLike exposes.

Return type:

None

Parameters:

path (Path)
storage_state (Mapping[str, object])
metadata (Mapping[str, object])

load(path)[source]¶

Load the PersistedBrowserSession for logical path.

Returns None when the logical key is absent. A present record is read from adapters.persistence.storage.AEAT_BROWSER_SESSION_NAMESPACE with the expected SensitivityClass and current namespace schema version.

Return type:: PersistedBrowserSession | None
Parameters:: path (Path)

delete(path)[source]¶

Delete the encrypted browser session for logical path.

Return type:: bool
Parameters:: path (Path)

storage_state_sha256(storage_state)[source]¶

Return the canonical SHA-256 for a Playwright storage-state payload.

Certificate auth and Cl@ve Móvil metadata store this fingerprint so resume paths can reject a metadata envelope that no longer matches the encrypted storage-state payload.

Return type:: str
Parameters:: storage_state (Mapping[str, object])

logical_object_key(path)[source]¶

Return the natural secure-object key for a browser-session path.

The key shape follows adapters.persistence.storage.AEAT_BROWSER_SESSION_NAMESPACE. SecureObjectRepository HMAC-digests this value before writing the row, so callers can use the same logical key without exposing it on disk.

Return type:: str
Parameters:: path (Path)