aeat.application.auth._certificate_sources module

Named multi-certificate source registry for the certificate auth provider.

A gestor managing several taxpayers typically holds several PKCS#12 certificates — their own personal certificate plus one apoderado certificate per represented entity. Before this module, the certificate auth provider carried exactly one certificate path (certificate_path), configured through aeat config auth configure --provider certificate --file PATH: adopting a different certificate meant re-running that command and losing track of the previous path.

This module adds a named registry (certificate_sources) on top of the existing single-path field: register_certificate_source() adds or re-points a named source, list_certificate_sources() enumerates them, select_certificate_source() marks one active and mirrors its path onto certificate_path (so every existing consumer — the backend health probe, live login preconditions, auth status / auth test — keeps reading the one field it already knows about), and remove_certificate_source() retires a registered source.

Rotation hooks (invalidating cached state when the active certificate changes on disk), a filesystem-fallback loader, external keyring/1Password backends, and service-account impersonation UX are explicitly out of scope for this module; see GitHub issue #591.

See also

AuthState

Persisted local auth selection embedded in workflow state; carries the certificate_sources registry and certificate_path mirror this module maintains.

configure_operator_auth()

Configures the active auth provider; this module manages certificate sources within the certificate provider.

exception CertificateSourceNoActiveBucketError[source]

Bases: Exception

Raised when a certificate-source mutation runs before an active profile bucket exists.

exception CertificateSourceNotFoundError[source]

Bases: KeyError

Raised when a requested certificate source name is not registered.

register_certificate_source(state, *, name, certificate_path, friendly_name=None)[source]

Register (or re-point) a named certificate source in state.

Adding a source with a name that already exists overwrites its certificate_path/friendly_name and refreshes registered_at rather than erroring — re-registration is the supported way to point an existing name at a renewed certificate file. Registering a source never changes which source is active; call select_certificate_source() explicitly to activate it.

Returns the updated WorkflowState.

Return type:

WorkflowState

Parameters:
list_certificate_sources(state)[source]

Return every registered CertificateSourceRecord.

Return type:

tuple[CertificateSourceRecord, ...]

Parameters:

state (WorkflowState)

active_certificate_source(state)[source]

Return the active CertificateSourceRecord, if any.

Return type:

CertificateSourceRecord | None

Parameters:

state (WorkflowState)

select_certificate_source(state, *, name)[source]

Mark the certificate source name active and mirror its path onto certificate_path.

Every other registered source stays registered but inactive. The provider selection (AuthState.provider) is left untouched: selecting a certificate source is orthogonal to choosing which auth provider is active, so an operator may register and select sources ahead of switching --provider certificate on.

Raises:

CertificateSourceNotFoundError – When name is not registered.

Parameters:
Return type:

WorkflowState

Returns the updated WorkflowState.

Return type:

WorkflowState

Parameters:
remove_certificate_source(state, *, name)[source]

Remove the certificate source name from the registry.

When name is the active source, the active selection is cleared (active_certificate_source becomes None); certificate_path is left as-is, matching the pre-existing single-certificate contract where clearing the path is a distinct auth clear operation.

Returns a (state, removed) tuple; removed is False when name was not registered (a no-op, not an error).

Return type:

tuple[WorkflowState, bool]

Parameters: