aeat.application.auth._models module

Strict pydantic v2 records for AEAT auth readiness.

AuthState is the workflow-state auth snapshot embedded in application.workflow.WorkflowState and updated by application.auth.update_auth(). Operator-facing status and test surfaces expose redacted readiness through application.state_projection.ProjectionAuthReadiness rather than re-reading this model independently.

class CertificateSourceRecord(**data)[source]

Bases: BaseModel

One named, registered PKCS#12 certificate source.

A gestor managing several entities (their own personal certificate plus one or more apoderado certificates) registers each certificate under a distinct name so the active one can be selected without re-supplying the filesystem path. Only the filesystem reference is stored here; certificate passwords, private keys, and session material never enter this record (or any persisted workflow state), matching the existing single-certificate contract.

Variables:

  • name – Operator-chosen identifier for this certificate source (e.g. "personal", "apoderado-empresa-x"). Unique within the active profile’s registry.

  • certificate_path – Filesystem path to the PKCS#12 (.p12/.pfx) bundle.

  • friendly_name – Optional human-readable label distinct from name, mirroring core.config.Settings.aeat_certificate_friendly_name.

  • registered_at – UTC timestamp the source was registered or last re-pointed at a different path.

Parameters:

  • name (str)

  • certificate_path (str)

  • friendly_name (str | None)

  • registered_at (datetime)

name: str
certificate_path: str
friendly_name: str | None
registered_at: datetime
class AuthState(**data)[source]

Bases: BaseModel

Persisted local AEAT access readiness state.

This record stores provider selection, the certificate filesystem reference, and local session timestamps inside application.workflow.WorkflowState. Public CLI emit shapes read the canonical projection into application.auth.AuthStatusResult and application.auth.AuthTestResult.

certificate_sources and active_certificate_source extend the single-certificate contract with a named multi-certificate registry: an operator (typically a gestor) may register several PKCS#12 sources — one per entity they act for — and select which one is active. certificate_path remains the single field the rest of the auth surface (backend probes, live login, health reporting) reads; selecting an active source mirrors its path onto certificate_path so every existing consumer keeps working unchanged.

Parameters:
provider: str | None
certificate_path: str | None
configured_at: datetime | None
authenticated_at: datetime | None
subject: str | None
certificate_sources: dict[str, CertificateSourceRecord]
active_certificate_source: str | None