cadrumo.application.auth.operator_scope module

Settings and active-profile storage scopes for auth operator services.

This module uses Settings to derive the auth operator configuration.

auth_operator_settings_scope(settings)

Yield a Settings for auth-operator probes.

Uses the supplied settings when provided, otherwise loads from the default path.

Return type:

Generator[Settings]

Parameters:

settings (Settings | None)

active_bucket_id_from_settings(settings)

Resolve the active bucket for settings without falling through to process globals.

Return type:

str | None

Parameters:

settings (Settings)

active_profile_storage_span(settings=None, *, target_bucket_id=None, operator_scope_ports)

Return a storage context for the explicit target or active profile.

Yields the resolved bucket id when the ambient BucketSession already serves the target, and None when no target resolves at all. Anything else is a refusal: an auth operation aimed at a profile whose custody session is not open cannot borrow one, because opening it needs the operator’s password. The caller is told to authenticate into that profile rather than silently reading whichever bucket happens to be bound.

Raises:

AuthOperationRequiresCustodySessionError – When a target bucket resolves but the ambient session does not serve it on the target root.

Parameters:

• settings (Settings | None)

• target_bucket_id (str | None)

• operator_scope_ports (OperatorScopePorts)

operator_auth_revocation_is_reachable(settings=None, *, bucket_id, operator_scope_ports)

Report whether an auth revocation for bucket_id could open its store.

Asks active_profile_storage_span() instead of re-deriving its reuse test, so “is this profile’s custody session open” keeps one authority. Entering the span yields a null context and performs no mutation, so this is a question rather than a half-executed operation.

A caller erasing a profile it has NOT unlocked uses this to choose between a real revocation and the key-free half, rather than driving control flow off a caught refusal.

Return type:

bool

Parameters:

• settings (Settings | None)

• bucket_id (str)

• operator_scope_ports (OperatorScopePorts)

auth_mutation_span(*, settings, bucket_id, operator_scope_ports)

Acquire or re-enter the canonical per-bucket auth mutation span.

Return type:

Generator[None]

Parameters:

• settings (Settings)

• bucket_id (str)

• operator_scope_ports (OperatorScopePorts)

assert_auth_cleanup_not_in_progress(state)

Refuse a new auth mutation while logout/reset recovery is pending.

Return type:

None

Parameters:

state (WorkflowState)

assert_certificate_secret_mutation_not_in_progress(state)

Refuse an auth mutation while certificate-secret recovery is pending.

Return type:

None

Parameters:

state (WorkflowState)

assert_auth_recovery_not_in_progress(state)

Refuse a new auth mutation while any durable auth recovery is pending.

Return type:

None

Parameters:

state (WorkflowState)

class AuthOperationScope(**data)

Bases: BaseModel

Resolved bucket and provider ids for an operator auth mutation.

Parameters:

data (Any)

bucket_id: BucketId

provider_ids: tuple[str, ...]

resolve_auth_operation_scope(*, bucket_id, current_provider, provider, all_providers)

Resolve one explicit provider, every known provider, or the configured provider.

Return type:

AuthOperationScope

Parameters:

• bucket_id (str)

• current_provider (str | None)

• provider (str | None)

• all_providers (bool)