aeat.adapters.persistence.storage.bucket._keystore_paths module¶

Keystore separation contract enforcing the isolation invariant.

The KEK / DEK / passphrase / OS-keystore custody artefacts live under a keystore root that is structurally outside the buckets parent. The two invariants enforced here are:

The keystore root is sibling to buckets/ under the AEAT root (<aeat-root>/keystore/<bucket-id>/), never nested inside any bucket directory and never co-located under the relational database directory.
A configuration that resolves the keystore path under either parent is rejected by validate_keystore_separation() so a subsequent unlock cannot silently violate the invariant.

The pure helpers do not materialise the directory; the cryptographic core (P03) owns provisioning when an enrolment first lands.

keystore_root(root)[source]¶

Return the keystore parent <root>/keystore/ (no IO).

Return type:: Path
Parameters:: root (Path)

keystore_path(root, bucket_id)[source]¶

Return <root>/keystore/<bucket_id>/ (no IO).

Parameters:

root (Path) – The AEAT root directory.
bucket_id (str) – Bucket identifier to include in the path.

Return type:

Path

Returns:

The computed keystore directory path.

Raises:

BucketValidationError – When bucket_id is empty or carries a path separator.

validate_keystore_separation(root, bucket_id, *, configured_keystore=None)[source]¶

Fail closed if the keystore path resolves under the buckets parent or db dir.

Parameters:

root (Path) – The AEAT root directory.
bucket_id (str) – The bucket identifier whose layout to validate against.
configured_keystore (Path | None) – Optional override path; defaults to keystore_path(). A custom configuration that points at a location nested under the buckets parent or the per-bucket relational database directory is rejected.

Raises:

BucketValidationError – When the configured keystore path violates separation.

Return type:

None