cadrumo.application.auth.credentials module

Resolve the active certificate credential from settings and workflow state.

resolve_certificate_source_secret(*, name, bucket_id, certificate_secret_backend_factory, settings=None)[source]

Return the passphrase registered for certificate source name.

Return type:

SecretStr | None

Parameters:
class ActiveAuthProjectionSnapshot(bucket_id, state, provider, certificate_credentials)[source]

Bases: object

Route-witnessed workflow state and certificate credential projection.

Parameters:
bucket_id: str | None
state: WorkflowState | None
provider: AuthProviderKind | None
certificate_credentials: ActiveCertificateCredentials | None
active_auth_projection_span(*, certificate_secret_backend_factory, settings=None, requested_provider=None, fallback_provider=None, operator_scope_ports)[source]

Pin one active route while loading state, provider, credentials, and consumers.

requested_provider has explicit operator precedence. fallback_provider applies only when neither the operator nor the witnessed workflow state selected a provider. Status/test callers omit the fallback so they never invent configuration; login/preflight can apply their established default without reopening the route.

Return type:

Generator[ActiveAuthProjectionSnapshot]

Parameters:
resolve_active_provider_kind(*, certificate_secret_backend_factory, settings=None, requested_provider=None, fallback_provider=None, operator_scope_ports)[source]

Resolve the provider kind the operator’s persisted selection names.

This is the one reader of “which provider is configured”, shared by the operator login surface and the live-read session bring-up so the two cannot disagree: the precedence is an explicit requested_provider, then the selection persisted by aeat config auth configure in the witnessed application.workflow.state_models.WorkflowState, then fallback_provider. Settings is a fallback, never an override, because the persisted selection is the operator’s recorded decision while a settings value is only a deployment default.

Failures are not swallowed: a locked or unreadable bucket propagates rather than falling through to the fallback, because silently resolving a provider the operator did not choose is the defect this reader exists to remove.

Return type:

AuthProviderKind | None

Parameters:
resolve_active_certificate_credentials(*, certificate_secret_backend_factory, settings=None, operator_scope_ports)[source]

Resolve the exact certificate credential selected for the active profile.

Return type:

ActiveCertificateCredentials

Parameters:
project_active_certificate_credentials(state, *, settings)[source]

Project selected certificate metadata without reading secure storage.

Caller-supplied workflow state carries no storage-route provenance. This boundary therefore never accepts a bucket identifier and always leaves a selected named source’s password absent. Secret-bearing credentials must be obtained through resolve_active_certificate_credentials(), which loads the workflow state inside its own witnessed active-profile span.

Return type:

ActiveCertificateCredentials

Parameters: