orxtra v0.13.0 /auth.src.orxtra.auth._backend
Updated
On this page

AuthBackend: asyncpg-backed storage for consumers and credentials. Persists consumers with caller-supplied ids, hashes credentials with SHA-256, and looks them up by id, hash, or consumer.

#auth.src.orxtra.auth._backend

#auth.src.orxtra.auth._backend

#AuthBackend

asyncpg-backed auth storage.

The pool is stored at construction time and used internally -- callers never pass it per-call. This fixes the previous design where middleware/Authenticator had no pool to pass.

#create_consumer

python
async def create_consumer(self, name: str, trust_tier: TrustTier, scope_grants: list[str], *, consumer_id: UUID, principal_id: UUID) -> UUID

Persist a consumer with a caller-supplied id and principal.

Both ids are generated by the caller before this call: the caller mints the consumer's own principal (kind=consumer, external_ref=consumer_id) first, so the principal exists before the row that FKs into it. Auth never imports identity -- the mint happens in the orchestrating layer and the resulting ids flow in here.

#get_consumer

python
async def get_consumer(self, consumer_id: UUID) -> ConsumerRecord | None

#disable_consumer

python
async def disable_consumer(self, consumer_id: UUID) -> None

#create_credential

python
async def create_credential(self, consumer_id: UUID, credential_type: str, raw_value: str, *, secret_ref: str | None=None) -> UUID

#get_credential_by_id

python
async def get_credential_by_id(self, credential_id: UUID) -> CredentialRecord | None

#get_credential_by_hash

python
async def get_credential_by_hash(self, credential_hash: str) -> CredentialRecord | None

#get_credentials_by_consumer

python
async def get_credentials_by_consumer(self, consumer_id: UUID, *, credential_type: str | None=None) -> list[CredentialRecord]
Search