#auth.src.orxtra.auth._authenticator

#auth.src.orxtra.auth._authenticator

Authenticator: thin dispatcher over a CredentialVerifier registry.

Each credential type (api_key, bearer, hmac) has a registered verifier. The Authenticator hashes the presented credential to find the record, then delegates to the appropriate verifier. Unregistered credential types are a construction-time hard error.

Every verification emits an audit event via an optional EventSink.

#AuthAuditEvent

Audit event emitted per verification attempt.

#Authenticator

Authenticates raw credentials against a backend via per-type verifiers.

Construction-time hard error if a credential type has no verifier.

#verify_by_credential_id

async def verify_by_credential_id(self, credential_id: UUID, presented_credential: str) -> AuthContext

Verify a credential looked up by ID rather than by hash.

Used by the webhook receiver where the credential_id is known from the source record. The presented_credential format is the same as for authenticate(): raw token for bearer/api_key, 'identifier:signature:message' for HMAC.

Raises AuthenticationError if the credential is not found, the verifier is missing, or verification fails.

#authenticate

async def authenticate(self, raw_credential: str) -> AuthContext

Authenticate a raw credential string.

For hash-based types (api_key, bearer), this is the raw token. For HMAC, this is 'identifier:signature:message'.

#_verify_with_record

async def _verify_with_record(self, cred: CredentialRecord, presented_credential: str) -> AuthContext

Verify a presented credential against a known credential record.

Shared by authenticate() (hash lookup) and verify_by_credential_id() (ID lookup). Delegates to the per-type verifier, emits audit events.