cadrumo.application.auth.certificate_secret_backend module

Application-owned capability contract for named certificate secrets.

Certificate authentication owns the policy around a named source: callers need a bucket-scoped capability that can resolve, rotate, remove, and witness a passphrase without knowing how the secret is kept at rest. The encrypted storage implementation is an outward adapter and is bound by each executable composition root below this contract.

The application never receives a persistence record. Reads project either a SecretStr or absence, and mutation retries use only the non-secret witness and operation-id methods declared here.

class CertificateSecretBackend(*args, **kwargs)

Bases: Protocol

Bucket-scoped capability for named certificate passphrases.

get(name)

Return the passphrase for name, or None when it is absent.

Return type:

SecretStr | None

Parameters:

name (str)

set(name, secret, *, operation_id=None, occurred_at=None)

Persist or rotate one named passphrase.

Return type:

None

Parameters:

• name (str)

• secret (SecretStr)

• operation_id (str | None)

• occurred_at (datetime | None)

remove(name)

Remove one named passphrase, returning whether it existed.

Return type:

bool

Parameters:

name (str)

mutation_operation_id(name)

Return the non-secret operation id attached to name, if present.

Return type:

str | None

Parameters:

name (str)

request_witness(name, secret)

Return a non-secret witness for an idempotent set/rotate retry.

Return type:

str

Parameters:

• name (str)

• secret (SecretStr)

class CertificateSecretBackendFactory(*args, **kwargs)

Bases: Protocol

Construct one certificate-secret capability for a routed bucket.