cadrumo.application.state_projection_auth module

Build the authentication sub-projection for operator state.

This focused public module owns the authentication sub-projection used by cadrumo.application.state_projection. It derives redacted, fail-closed readiness from either an active-auth snapshot or direct state.

class ProjectionAuthReadiness(**data)[source]

Bases: BaseModel

Redacted authentication readiness with route provenance.

A provider is configured only when its typed value exactly matches the persisted selector; the certificate provider additionally requires its effective path to exist. Invalid selectors remain unconfigured and are never exposed through projection output. A backend probe may downgrade configuration and supplies only the health and probe fields.

Parameters:

data (Any)

provider: str
configured: bool
authenticated: bool
available: bool
health_summary: str
health_severity: str
certificate_path: str
probe_result: ProviderProbeResult | None
probe_summary: str
build_auth_readiness(state, *, certificate_secret_backend_factory, operator_probe_ports, operator_scope_ports, provider_kind, provider_kind_is_authoritative, requested_provider, probe_live_backend, credential_bucket_id, certificate_credentials)[source]

Build redacted authentication readiness from a snapshot or direct state.

Snapshot-backed and direct-state paths enforce the same exact-match and existing-certificate rule. Invalid selectors fail closed without exposing their raw value. Snapshot credentials retain their witnessed storage route; direct state cannot borrow one. A backend probe may downgrade configured readiness, but never elevate it.

Return type:

ProjectionAuthReadiness

Parameters:
build_auth_readiness_without_live_backend(state, *, provider_kind, provider_kind_is_authoritative, requested_provider, credential_bucket_id, certificate_credentials)[source]

Project local readiness without acquiring a live backend capability.

Wizard status is a local workflow projection and deliberately does not probe external or secure-storage backends. Keeping this path separate means it has no hidden certificate-secret dependency while the live projection above still requires its factory explicitly.

Return type:

ProjectionAuthReadiness

Parameters: