cadrumo.application.auth.operator_probes module

Local auth provider and persisted-session probes for operator services.

The local probe path classifies AuthProviderKind configuration with ProviderProbeResult values and reuses persisted-session metadata via load_persisted_session().

classify_identity_alignment(profile_tax_id, provider_identity)[source]

Classify a Cl@ve Móvil identity against the active profile tax id.

The single home for the five-way alignment ladder shared by the live identity-state probe and _auth_configure_result. Inputs are the already-normalised (stripped, upper-cased) tax id and provider identity.

Return type:

str

Parameters:

  • profile_tax_id (str)

  • provider_identity (str)

probe_clave_credentials(provider_kind, *, settings, state=None, operator_probe_ports)[source]

Resolve the credentials a readiness probe should report on.

Routes through the same resolver the live session entry uses, so a surface cannot report a credential as unconfigured that the session entry would authenticate with. Unlike the session entry this never refuses: an absent credential is the state being reported, not a fault.

Return type:

ClaveCredentials | None

Parameters:
bind_profile_auth_settings(provider_kind, *, settings, state=None, operator_probe_ports)[source]

Bind the profile credentials that the selected backend will actually use.

Status and live authentication must construct a provider from the same effective settings. This uses the live session resolver and binder rather than reproducing their precedence rules in a readiness-only projection.

Return type:

Settings

Parameters:
live_auth_identity_state(provider_kind, *, settings, state=None, operator_probe_ports)[source]

Project whether the configured live-auth identity is usable.

Return type:

tuple[bool, bool, str]

Parameters:
live_auth_identity_kind(provider_kind, *, settings, state=None, operator_probe_ports)[source]

Return the safe identity-kind label for the configured provider.

Return type:

str

Parameters:
live_auth_mode(provider_kind, *, settings)[source]

Project the configured interactive mode without acquiring a session.

Return type:

str

Parameters:
probe_local_session(provider, *, settings=None, operator_scope_ports)[source]

Inspect the persisted AEAT session token for provider on disk.

A pure local read — it never opens a browser or contacts AEAT. It answers the question auth status cannot: is there actually a usable session token on disk for this provider right now.

Return type:

_LocalSessionProbe

Parameters:
class ProviderConfigurationProbe(**data)[source]

Bases: BaseModel

Public per-provider local configuration readiness verdict.

Wraps the pure-local probe_provider_credentials() (no network, no active-profile requirement) so the workstation doctor (aeat config check) can render one certificate / Cl@ve Móvil readiness row per core.auth_provider.AuthProviderKind directly from core.config.Settings. result is the typed ProviderProbeResult; summary is the localised one-line operator-facing verdict.

Parameters:

data (Any)

provider: str
result: ProviderProbeResult
summary: str
probe_provider_configuration(provider, *, settings=None, operator_probe_ports)[source]

Run the pure-local per-provider configuration probe for provider.

Resolves the certificate path or Cl@ve Móvil identity from core.config.Settings and classifies the local configuration health without any network call or active-profile session. Returns a typed ProviderConfigurationProbe; it never raises for a missing or malformed configuration — an absent provider surfaces as ProviderProbeResult.NO_PATH_SET / ProviderProbeResult.IDENTITY_UNSET, a broken one as expired / corrupt / invalid_identity.

Return type:

ProviderConfigurationProbe

Parameters:
probe_provider_credentials(provider, certificate_path, *, settings=None, certificate_credentials=None, operator_probe_ports)[source]

Probe one provider using the caller’s already-resolved credential snapshot.

Return type:

ProviderConfigurationProbe

Parameters:
probe_certificate_bundle(certificate_path, *, settings=None, certificate_credentials=None, operator_probe_ports)[source]

Open the configured .p12 and classify the certificate’s health.

Resolves the three certificate-state cases distinctly: no path, path-set-file-missing, path-set-file-present. The file-present case additionally opens the bundle and inspects expiry through adapters.outbound.aeat.auth.certificate.health(), which reports EXPIRED for an already-lapsed certificate rather than raising — an expired but otherwise well-formed bundle must classify as expired, never corrupt.

Return type:

_ProviderProbeOutcome

Parameters: