orxtra v0.13.0 /auth.src.orxtra.auth._verifiers
Updated
On this page

Per-credential-type verification: HashCredentialVerifier compares SHA-256 hashes for bearer/api_key tokens; HmacCredentialVerifier delegates to a KeyedMacProvider without seeing raw key material.

#auth.src.orxtra.auth._verifiers

#auth.src.orxtra.auth._verifiers

Per-credential-type verification strategies.

HashCredentialVerifier: for bearer/api_key credentials stored as SHA-256 hashes. Needs zero secret capability.

HmacCredentialVerifier: for HMAC credentials verified via a KeyedMacProvider. The provider is injected at construction; the verifier never sees raw key material.

#HashCredentialVerifier

Verifies bearer/api_key credentials via SHA-256 hash comparison.

Needs zero secret capability -- the hash is stored at rest and compared against the hash of the presented credential.

#credential_type

python
def credential_type(self) -> str

#verify

python
async def verify(self, credential_record: CredentialRecord, presented_credential: str) -> AuthContext

#HmacCredentialVerifier

Verifies HMAC credentials via a KeyedMacProvider.

The provider is injected at construction. The verifier extracts the secret_ref from the credential record and delegates to the provider's verify() method. Raw key material never crosses into the auth module.

#credential_type

python
def credential_type(self) -> str

#verify

python
async def verify(self, credential_record: CredentialRecord, presented_credential: str) -> AuthContext
Search