aeat.adapters.persistence.storage.runtime module

Storage runtime readiness models.

The runtime is the public diagnostic boundary for profile-bound secure storage. It reports whether the current process is attached to an active profile bucket and has an unlocked bucket session, without exposing key material or constructing repositories. The SecureObjectRepository factories are layered on top of this readiness contract.

class StorageRuntimeReadinessCode(*values)[source]

Bases: StrEnum

Machine-readable secure-storage runtime readiness states.

READY
NO_ACTIVE_SESSION
SESSION_SEALED
SESSION_EXPIRED
UNSECURED_BACKEND
ROUTE_NOT_ACTIVE_BUCKET
ROUTE_BUCKET_MISMATCH
class StorageRuntimeReadinessIssue(**data)[source]

Bases: BaseModel

One reason the runtime is not ready for profile-bound storage.

Parameters:
code: StorageRuntimeReadinessCode
message_key: str
message: str
recovery_hint: str
class StorageRuntimeSession(**data)[source]

Bases: BaseModel

Key-material-free projection of the active bucket session.

Parameters:
active: bool
idle_deadline: datetime
sealed: bool
expired: bool
unsecured_backend: bool
class StorageRuntimeReadiness(**data)[source]

Bases: BaseModel

Profile-bound storage readiness result.

Parameters:
ready: bool
code: StorageRuntimeReadinessCode
issues: tuple[StorageRuntimeReadinessIssue, ...]
class StorageRuntime(**data)[source]

Bases: BaseModel

Current secure-storage runtime state.

This model deliberately carries only redacted diagnostics: route kind, active-session state, and readiness. It does not expose KEK/DEK bytes, profile UUIDs, database URLs, database paths, or storage-root paths.

Parameters:
route_kind: StorageRouteKind
route_attached_to_active_bucket: bool
route_has_database_path: bool
storage_root: Path
bucket_id: str
active_session: StorageRuntimeSession | None
readiness: StorageRuntimeReadiness
require_ready()[source]

Raise when this runtime cannot serve profile-bound storage.

Return type:

None

secure_object_repository()[source]

Create a SecureObjectRepository attached to this runtime’s bucket.

Return type:

SecureObjectRepository

runtime_not_ready_error(message, *, message_key)[source]

Build a localized storage-runtime readiness failure returning a StorageValidationError.

Return type:

StorageValidationError

Parameters:

  • message (str)

  • message_key (str)

inspect_storage_runtime(settings=None, *, now=None)[source]

Return the current profile-bound secure-storage StorageRuntime state.

Return type:

StorageRuntime

Parameters:
inspect_bucket_storage_runtime(bucket_id, settings=None, *, now=None)[source]

Return a StorageRuntime with readiness diagnostics for a named profile bucket.

Explicit database URLs remain fail-closed: when the live settings carry an explicit primary database route, the runtime reports that route as unready instead of synthesizing a clean bucket route.

Return type:

StorageRuntime

Parameters: