cadrumo.application.user_profile.login_interaction module

Frontend-neutral interaction contract for selecting and unlocking a profile.

class ProfileLoginChoice(profile_id, label)[source]

Bases: object

One committed profile available to an authentication chooser.

Parameters:

  • profile_id (str)

  • label (str)

profile_id: str
label: str
class ProfileLoginAttempt(outcome=None, refusal=None)[source]

Bases: object

A completed login operation represented without frontend exceptions.

Parameters:
outcome: ProfileLoginOutcome | None
refusal: str | None
class ProfileLoginInventoryState(*values)[source]

Bases: StrEnum

Truthful result of the non-authenticating profile inventory read.

A surface that offers a sign-in must know which of four situations it is in, and the difference matters to the operator in each case. An inventory that could not be read is NOT an empty one: reporting a degraded store as “no profiles yet” invites the operator to create a second profile beside the one the reader failed to see.

RECOGNIZED

The store was read and offers at least one profile to sign into.

CONCURRENT_CHANGE

The store changed underneath the read; nothing is offered.

DEGRADED

The store could not be read truthfully; nothing is offered.

EMPTY

The store was read and holds no profile; registration is the next step.

class ProfileLoginInventoryV1(state, choices=(), preselected_profile_id=None, reason_code=None)[source]

Bases: object

One immutable inventory observation, carrying no credential material.

reason_code is present exactly on the two unavailable states and names the condition for an operator-facing report. choices and preselected_profile_id are populated only when the inventory is recognized, so a caller cannot offer a sign-in the store does not support.

Parameters:
state: ProfileLoginInventoryState
choices: tuple[ProfileLoginChoice, ...]
preselected_profile_id: str | None
reason_code: str | None
profile_login_choices()[source]

Return committed profiles in the stable chooser order.

Return type:

tuple[ProfileLoginChoice, ...]

preselected_profile_login_id(name)[source]

Resolve the profile an authentication chooser should open on.

Return type:

str | None

Parameters:

name (str | None)

observe_profile_login_inventory(*, inventory_reader=<function summary_inventory>, choice_reader=<function profile_login_choices>, preselection_reader=<function preselected_profile_login_id>)[source]

Read which profiles can be signed into, without unlocking any of them.

This observation authenticates nothing and opens no custody session. It is the question every sign-in surface asks first, and it is kept apart from admission on purpose: whether the store can be read is a different fact from whether a particular profile can be unlocked, and a surface that conflated them reported a locked profile as a missing one.

The choices are re-read against the same inventory rather than trusted, because the two reads can straddle a concurrent registration or deletion. A disagreement is reported as degraded rather than resolved by preferring one of them.

Return type:

ProfileLoginInventoryV1

Parameters:
attempt_profile_login(profile_id, passphrase, *, profile_decode_context)[source]

Unlock a chosen profile under the caller’s pinned schema context.

The credential screen is deliberately frontend-neutral, so it receives the decode context that the workflow owner already pinned. Opening an authority here would allow the screen to authenticate against a different generation from the surrounding bootstrap/session composition.

Return type:

ProfileLoginAttempt

Parameters: