cadrumo.application.auth.operator_cleanup module

Canonical durable auth cleanup planning and application helpers.

provider_kind(provider_id)

Resolve a provider id without accepting unknown values.

Return type:

AuthProviderKind | None

Parameters:

provider_id (str)

delete_scoped_sessions(settings, provider_ids, *, bucket_id)

Delete sessions for the requested providers within one profile bucket.

Return type:

tuple[int, tuple[str, ...]]

Parameters:

• settings (Settings)

• provider_ids (tuple[str, ...])

• bucket_id (str)

clear_scoped_locks(settings, provider_ids, *, bucket_id, allow_held=False)

Clear acquisition locks for the requested providers and bucket.

Return type:

tuple[int, tuple[str, ...]]

Parameters:

• settings (Settings)

• provider_ids (tuple[str, ...])

• bucket_id (str)

• allow_held (bool)

clear_operator_auth_acquisition_locks(settings, *, bucket_id, allow_held=False)

Clear every provider’s acquisition lock for bucket_id without its key.

The lock is a plaintext file under the token directory, outside the profile capsule, so clearing it needs no custody session – and destroying the capsule does not reap it, which is why a caller erasing a profile clears it explicitly rather than leaving it to the deletion.

Every provider kind is swept because the workflow state naming the configured provider lives INSIDE the capsule and is unreadable while the profile is locked. Clearing an absent lock is a no-op, so the sweep costs a stat per kind and reports only the locks that were actually there.

Return type:

tuple[str, ...]

Returns:

The provider ids whose lock was present and has been cleared.

Parameters:

• settings (Settings)

• bucket_id (str)

• allow_held (bool)

delete_certificate_source_secrets(*, certificate_secret_backend_factory, settings, bucket_id, names)

Delete the named certificate secrets from one bucket’s secure backend.

Return type:

int

Parameters:

• certificate_secret_backend_factory (CertificateSecretBackendFactory)

• settings (Settings)

• bucket_id (str)

• names (tuple[str, ...])

assert_logout_request_matches(intent, *, provider, all_providers)

Refuse when a durable logout intent differs from the current request.

Return type:

None

Parameters:

• intent (AuthCleanupIntent)

• provider (str | None)

• all_providers (bool)

auth_cleanup_intent_has_effects(intent)

Return whether a durable cleanup intent still names removable state.

Return type:

bool

Parameters:

intent (AuthCleanupIntent)

assert_reset_request_matches(intent, *, provider, all_providers)

Refuse when a durable reset intent differs from the current request.

Return type:

None

Parameters:

• intent (AuthCleanupIntent)

• provider (str | None)

• all_providers (bool)

build_auth_cleanup_intent(*, certificate_secret_backend_factory, settings, bucket_id, auth, provider_ids, all_providers, operation_kind, started_at)

Return type:

AuthCleanupIntent

Parameters:

• certificate_secret_backend_factory (CertificateSecretBackendFactory)

• settings (Settings)

• bucket_id (str)

• auth (AuthState)

• provider_ids (tuple[str, ...])

• all_providers (bool)

• operation_kind (AuthCleanupOperationKind)

• started_at (datetime)

apply_auth_cleanup_intent(auth, intent)

Apply one validated cleanup intent to the encrypted auth state.

Return type:

tuple[AuthState, tuple[str, ...], tuple[str, ...]]

Parameters:

• auth (AuthState)

• intent (AuthCleanupIntent)

auth_cleanup_bucket_events(*, intent, provider_ids, certificate_names)

Project durable bucket events for one completed auth cleanup intent.

Return type:

tuple[AuthBucketEventSpec, ...]

Parameters:

• intent (AuthCleanupIntent)

• provider_ids (tuple[str, ...])

• certificate_names (tuple[str, ...])