aeat.application.auth._certificate_sources_operator module

Operator-facing certificate-source registry verbs for the config CLI.

Wraps the pure _certificate_sources state transformations with the same active-bucket gating, secure-object persistence, and typed bucket-event emission that configure_operator_auth() uses, so registering, listing, selecting, or removing a named certificate source is exposed through aeat config auth certificate ... with identical safety guarantees.

check_operator_certificate_sources() extends the registry with expiry/rotation awareness: it re-runs the same local PKCS#12 health probe the single-certificate auth test path already performs (_operator_probes) against every registered source rather than only the active certificate_path, so a gestor managing several apoderado certificates gets a renewal reminder for each one individually.

See also

_certificate_sources

Pure WorkflowState transformations this module persists.

configure_operator_auth()

Sibling operator verb configuring the active auth provider; this module manages named certificate sources within the certificate provider.

probe_provider_configuration()

Sibling single-certificate expiry probe this module’s check_operator_certificate_sources() reuses per named source.

register_operator_certificate_source(*, name, certificate_path, friendly_name=None)[source]

Register (or re-point) a named certificate source for the active profile.

Raises:
Return type:

CertificateSourceMutationResult

Returns:

A CertificateSourceMutationResult.

Parameters:

  • name (str)

  • certificate_path (Path)

  • friendly_name (str | None)

list_operator_certificate_sources()[source]

Return every registered certificate source for the active profile.

Return type:

CertificateSourceListResult

Returns:

A CertificateSourceListResult.

select_operator_certificate_source(*, name)[source]

Mark name the active certificate source for the active profile.

Selecting a source mirrors its path onto AuthState.certificate_path so every existing certificate-provider consumer (the backend health probe, live login preconditions, auth status/auth test) reads the newly selected source without further changes.

Raises:
Return type:

CertificateSourceMutationResult

Returns:

A CertificateSourceMutationResult.

Parameters:

name (str)

remove_operator_certificate_source(*, name)[source]

Remove the named certificate source from the active profile’s registry.

A name that is not registered is a no-op (removed=False), not an error, matching the idempotent-removal convention used elsewhere in the auth surface.

Raises:
Return type:

CertificateSourceMutationResult

Returns:

A CertificateSourceMutationResult.

Parameters:

name (str)

check_operator_certificate_sources(*, settings=None)[source]

Classify expiry/rotation health for every registered certificate source.

Reuses the same local PKCS#12 probe (_probe_certificate_bundle()) the single-certificate auth test path already runs — classifying ok / expiring / expired / corrupt / unreadable / file_missing — but applies it to every named source in the registry rather than only the active certificate_path. A gestor with several apoderado certificates therefore gets one renewal reminder per entity, not only for whichever certificate happens to be selected.

Each source’s passphrase resolves through resolve_certificate_source_secret() first (the per-source CertificateSecretBackend); when no per-source secret is registered, the probe falls back to the shared, env-only aeat_certificate_password_secret — preserving the pre-registry single-certificate contract for sources that never adopted a per-source secret.

This is a pure read: it does not require an active profile bucket beyond what loading workflow state needs, and it never mutates state or emits a bucket event.

Return type:

CertificateSourceCheckReport

Returns:

A CertificateSourceCheckReport with one CertificateSourceCheckEntry per registered source, sorted by name (matching list_operator_certificate_sources()).

Parameters:

settings (Settings | None)

resolve_certificate_source_secret(*, name, bucket_id, backend_kind=CertificateSecretBackendKind.SECURE_STORAGE)[source]

Return the passphrase registered for certificate source name, or None.

Reads through certificate_secret_backend() scoped to bucket_id; never falls back to a global setting itself — callers that also want the legacy aeat_certificate_password_secret fallback (single-certificate, pre-registry contract) compose that fallback explicitly, keeping the precedence visible at the call site rather than hidden inside this resolver.

Return type:

SecretStr | None

Parameters:
set_operator_certificate_source_secret(*, name, secret, backend_kind=CertificateSecretBackendKind.SECURE_STORAGE)[source]

Set (or rotate) the passphrase for a registered certificate source.

The named source MUST already be registered (register_operator_certificate_source()) — a secret is bound to an existing source, never freestanding. The secret itself is never persisted to WorkflowState or emitted in the mutation result; only whether one is now present and which backend holds it.

Raises:
Return type:

CertificateSourceSecretMutationResult

Returns:

A CertificateSourceSecretMutationResult.

Parameters:
remove_operator_certificate_source_secret(*, name, backend_kind=CertificateSecretBackendKind.SECURE_STORAGE)[source]

Remove the persisted passphrase for a registered certificate source.

A name with no registered secret is a no-op (removed=False), matching the idempotent-removal convention used elsewhere on the auth surface.

Raises:
Return type:

CertificateSourceSecretMutationResult

Returns:

A CertificateSourceSecretMutationResult.

Parameters: