cadrumo.application.auth.certificate_sources module

Named multi-certificate source registry for the certificate auth provider.

A gestor managing several taxpayers typically holds several PKCS#12 certificates — their own personal certificate plus one apoderado certificate per represented entity. Before this module, the certificate auth provider carried exactly one certificate_path on AuthState, configured through aeat config auth configure --provider certificate --file PATH: adopting a different certificate meant re-running that command and losing track of the previous path.

This module adds a named certificate_sources registry to AuthState: register_certificate_source() adds or re-points a named source, list_certificate_sources() enumerates them, select_certificate_source() marks one active for the canonical credential resolver, and remove_certificate_source() retires a registered source.

Rotation hooks (invalidating cached state when the active certificate changes on disk), a filesystem-fallback loader, external keyring/1Password backends, and service-account impersonation UX are explicitly out of scope for this module.

See also

AuthState

Persisted local auth selection embedded in workflow state.

configure_operator_auth()

Configures the active auth provider; this module manages certificate sources within the certificate provider.

auth_state(state)[source]

Return state’s typed authentication state.

Return type:

AuthState

Parameters:

state (WorkflowState)

register_certificate_source(state, *, name, certificate_path, friendly_name=None)[source]

Register (or re-point) a named certificate source in state.

Adding a source with a name that already exists overwrites its certificate_path/friendly_name and refreshes registered_at rather than erroring — re-registration is the supported way to point an existing name at a renewed certificate file. Registering a source never changes which source is active; call select_certificate_source() explicitly to activate it.

Returns the updated WorkflowState.

Return type:

WorkflowState

Parameters:
list_certificate_sources(state)[source]

Return every registered CertificateSourceRecord.

Return type:

tuple[CertificateSourceRecord, ...]

Parameters:

state (WorkflowState)

active_certificate_source(state)[source]

Return the active CertificateSourceRecord, if any.

Return type:

CertificateSourceRecord | None

Parameters:

state (WorkflowState)

select_certificate_source(state, *, name)[source]

Mark the certificate source name active.

Every other registered source stays registered but inactive. The provider selection (AuthState.provider) is left untouched: selecting a certificate source is orthogonal to choosing which auth provider is active, so an operator may register and select sources ahead of switching --provider certificate on.

Raises:

CertificateSourceNotFoundError – When name is not registered.

Parameters:
Return type:

WorkflowState

Returns the updated WorkflowState.

Return type:

WorkflowState

Parameters:
remove_certificate_source(state, *, name)[source]

Remove the certificate source name from the registry.

When name is the active source, the active selection is cleared. A same-path unnamed credential is cleared too; a removed named source must not remain effective through the unnamed field.

Returns a (state, removed) tuple; removed is False when name was not registered (a no-op, not an error).

Return type:

tuple[WorkflowState, bool]

Parameters: