aeat.adapters.outbound.aeat.auth package

Public outbound AEAT auth facade.

This package mirrors the application auth contract from application.auth by re-exporting application.auth.AuthProvider and application.auth.AuthProviderKind alongside the concrete certificate, Cl@ve Móvil, and Cl@ve Permanente providers. Use select_provider() to resolve CERTIFICATE to AeatAuthenticator and CLAVE_MOVIL to ClaveMovilAuthProvider, or CLAVE_PERMANENTE to ClavePermanenteAuthProvider; unsupported kinds raise AuthConfigurationError.

Authentication results are strict, frozen, secret-free records: AeatSession and AeatLoginAssertion carry provider-specific payloads through the discriminated AuthSessionDetail and AuthLoginAssertionDetail unions. Selected certificate public API is available through adapters.outbound.aeat.auth.certificate, including adapters.outbound.aeat.auth.certificate.load_certificate(), adapters.outbound.aeat.auth.certificate.verify_handshake(), and adapters.outbound.aeat.auth.certificate.health().

Live-read policy is owned by core.access_gate.AeatAccessGate: pytest live reads require the live-test opt-in enabled, while operator-context reads continue through auth, profile, and read-only guards. The associated core.access_gate.AeatGateEnvSnapshot records only the live-test opt-in flag and the current pytest test id. Live AEAT writes and live AEAT submissions are permanently refused by core.access_gate.LiveSubmitForbiddenError; auth exposes no AEAT-side write verb.

Errors remain typed at the facade boundary, including AuthError, AuthConfigurationError, AeatLoginAssertionError, AeatSessionExpiredError, certificate errors, and Cl@ve Móvil errors.

select_provider(kind, *, settings, browser_session_factory=None)[source]

Return the concrete outbound AuthProvider for kind.

AuthProviderKind.CERTIFICATE builds an AeatAuthenticator; AuthProviderKind.CLAVE_MOVIL builds a ClaveMovilAuthProvider; AuthProviderKind.CLAVE_PERMANENTE builds a ClavePermanenteAuthProvider. The optional browser session factory is forwarded to browser-backed providers so application code can share Playwright sessions without depending on adapter internals.

Raises:

AuthConfigurationError – If kind is outside the supported AuthProviderKind set.

Return type:

AuthProvider

Parameters:

Subpackages

Submodules