cadrumo.application.auth.certificate_source_operations module

Operator-facing certificate-source registry verbs for the config CLI.

Wraps the pure certificate_sources state transformations with the same active-bucket gating, secure-object persistence, and typed bucket-event emission that configure_operator_auth() uses, so registering, listing, selecting, or removing a named certificate source is exposed through aeat config auth certificate ... with identical safety guarantees.

check_operator_certificate_sources() extends the registry with expiry/rotation awareness: it re-runs the same local PKCS#12 health probe the single-certificate auth test path already performs (operator_probes) against every registered source rather than only the active certificate_path, so a gestor managing several apoderado certificates gets a renewal reminder for each one individually.

See also

certificate_sources

Pure WorkflowState transformations this module persists.

configure_operator_auth()

Sibling operator verb configuring the active auth provider; this module manages named certificate sources within the certificate provider.

probe_provider_configuration()

Sibling single-certificate expiry probe this module’s check_operator_certificate_sources() reuses per named source.

register_operator_certificate_source(*, name, certificate_path, friendly_name=None, operation, operator_scope_ports)[source]

Register (or re-point) a named certificate source for the active profile.

Raises:
Return type:

CertificateSourceMutationResult

Returns:

A CertificateSourceMutationResult.

Parameters:
list_operator_certificate_sources()[source]

Return every registered certificate source for the active profile.

Return type:

CertificateSourceListResult

Returns:

A CertificateSourceListResult.

select_operator_certificate_source(*, name, operation, operator_scope_ports)[source]

Mark name the active certificate source for the active profile.

The canonical credential resolver reads the selected registry record directly; no duplicate path mirror is written.

Raises:
Return type:

CertificateSourceMutationResult

Returns:

A CertificateSourceMutationResult.

Parameters:
remove_operator_certificate_source(*, name, operation, operator_scope_ports)[source]

Remove the named certificate source from the active profile’s registry.

A name that is not registered is a no-op (removed=False), not an error, matching the idempotent-removal convention used elsewhere in the auth surface.

Raises:
Return type:

CertificateSourceMutationResult

Returns:

A CertificateSourceMutationResult.

Parameters:
check_operator_certificate_sources(*, certificate_secret_backend_factory, operator_probe_ports, operator_scope_ports, settings=None)[source]

Classify expiry/rotation health for every registered certificate source.

Reuses the same local PKCS#12 probe (probe_certificate_bundle()) the single-certificate auth test path already runs — classifying ok / expiring / expired / corrupt / unreadable / file_missing — but applies it to every named source in the registry rather than only the active certificate_path. A gestor with several apoderado certificates therefore gets one renewal reminder per entity, not only for whichever certificate happens to be selected.

Every named source’s passphrase resolves only through resolve_certificate_source_secret() (through the per-source secure-storage backend). An absent secret or secure-storage read failure is projected explicitly as None so the probe fails closed; a named source never inherits the global cadrumo_certificate_password_secret. The unnamed Settings credential remains the supported single-certificate contract only when no named source is selected and therefore is never part of this registry-wide check.

This is a pure read: it opens the explicit or active profile’s storage session when needed, but it never mutates state or emits a bucket event.

Return type:

CertificateSourceCheckReport

Returns:

A CertificateSourceCheckReport with one CertificateSourceCheckEntry per registered source, sorted by name (matching list_operator_certificate_sources()).

Parameters:
set_operator_certificate_source_secret(*, name, secret, certificate_secret_backend_factory, operation, operator_scope_ports)[source]

Set (or rotate) the passphrase for a registered certificate source.

The named source MUST already be registered (register_operator_certificate_source()) — a secret is bound to an existing source, never freestanding. The secret always persists to the sole encrypted secure-storage backend; there is no backend choice. The secret itself is never persisted to WorkflowState or emitted in the mutation result; only whether one is now present.

Raises:
Return type:

CertificateSourceSecretMutationResult

Returns:

A CertificateSourceSecretMutationResult.

Parameters:
remove_operator_certificate_source_secret(*, name, certificate_secret_backend_factory, operation, operator_scope_ports)[source]

Remove the persisted passphrase for a registered certificate source.

A name with no registered secret is a no-op (removed=False), matching the idempotent-removal convention used elsewhere on the auth surface. The removal always targets the sole encrypted secure-storage backend; there is no backend choice and no keyring cleanup path.

Raises:
Return type:

CertificateSourceSecretMutationResult

Returns:

A CertificateSourceSecretMutationResult.

Parameters: