qfa.services.auth_orchestrator#

Application service for authentication and management operations.

Classes

AuthOrchestrator(auth_lookup_ports, ...)

Coordinate key and tenant lookup and management across configured ports.
class qfa.services.auth_orchestrator.AuthOrchestrator(auth_lookup_ports: list[AuthLookupPort], auth_management_port: AuthManagementPort)[source]#

Bases: object

Coordinate key and tenant lookup and management across configured ports.

Initialize a AuthOrchestrator manager with lookup and management ports.

Parameters:

  • auth_lookup_ports (list[AuthLookupPort]) – One or more authentication lookup ports used to validate keys and list keys.

  • auth_management_port (AuthManagementPort) – The auth-management port used for mutations.

async validate_api_key(api_key: str) → TenantApiKey[source]#

Validate an API key against available authentication backends.

Parameters:

api_key (str) – API key supplied by the caller.

Returns:

The matching tenant API key record.

Return type:

TenantApiKey

Raises:

AuthenticationError – If no configured authentication backend recognizes the key.

async add_tenant(tenant_name: str, allows_superusers: bool = False) → str[source]#

Add a new tenant through the configured auth-management backend.

Parameters:

  • tenant_name (str) – The name of the tenant to create.

  • allows_superusers (bool) – Whether this tenant allows creation of superuser keys (default False).

Returns:

The unique identifier of the created tenant.

Return type:

str

async delete_tenant(tenant_id: str) → None[source]#

Delete an existing tenant through the configured auth-management backend.

Parameters:

tenant_id (str) – The unique identifier of the tenant to delete.

async add_key(key_name: str, tenant_id: str, is_superuser: bool = False) → KeyCreationResponse[source]#

Add a key through the configured auth-management backend.

Parameters:

  • key_name (str) – A human-friendly name for the key.

  • tenant_id (str) – The tenant this key belongs to.

  • is_superuser (bool) – Whether this key should have superuser privileges (default False).

Returns:

The created key identifier and plaintext API key as (key_id, api_key).

Return type:

tuple[str, str]

async delete_key(key_id: str) → None[source]#

Delete a key through the configured auth-management backend.

Parameters:

key_id (str) – Unique identifier of the tenant API key record to remove.

async get_tenants() → list[TenantInfo][source]#

Get all tenants through the configured auth-management backend.

Returns:

List of tenant metadata objects (tenant_id, name, allows_superusers).

Return type:

list[TenantInfo]

async get_auth_keys(tenant_id: str | None = None) → list[AuthKeyInfo][source]#

Get all API keys through the configured auth-management backend.

Can be filtered by tenant_id if provided.

Parameters:

tenant_id (str) – Unique identifier of the tenant to list keys for.

Returns:

List of API key informations associated with the tenant.

Return type:

list[AuthKeyInfo]