qfa.adapters.env_auth

Environment-based authentication lookup adapter.

Classes

EnvironmentAuthLookupAdapter(api_keys)

AuthLookupPort implementation backed by a static list of API keys.

class qfa.adapters.env_auth.EnvironmentAuthLookupAdapter(api_keys: list[TenantApiKey])

Bases: AuthLookupPort

AuthLookupPort implementation backed by a static list of API keys.

Keys are injected at construction time (e.g. loaded from the AUTH_API_KEYS environment variable via AuthSettings). No external I/O is performed; every lookup is an in-process scan.

Parameters:

api_keys (list[TenantApiKey]) – The full set of valid API keys to validate against.

async validate_api_key(provided_key: str) → TenantApiKey | None

Return the matching TenantApiKey, or None if no key matches.

Uses TenantApiKey.matches_key (secrets.compare_digest) for constant-time comparison and always iterates all keys to avoid leaking information about how many keys are registered.

Parameters:

provided_key (str) – The API key value supplied by the caller.

Returns:

The matching tenant API key, or None if no match was found.

Return type:

TenantApiKey | None

async get_auth_keys(tenant_id: str | None = None) → list[AuthKeyInfo]

Return API key metadata for the given tenant, or all tenants.

Sensitive fields (hashed_key) are excluded from the returned dicts.

Parameters:

tenant_id (str | None) – Filter by this tenant identifier, or None to return keys for all tenants.

Returns:

A list of AuthKeyInfo objects with auth key information (no secret values).

Return type:

list[AuthKeyInfo]