roboto.domain.tokens#

Create, acquire, and manage personal access tokens.

Submodules#

Package Contents#

class roboto.domain.tokens.CreateCredentialRequest(/, **data)#

Bases: pydantic.BaseModel

Request payload to create a credential request.

The CLI redeems the request for a personal access token after a user approves it in the browser.

Parameters:

data (Any)

client_hostname: str#

1-255 printable ASCII characters, declared by the client.

Type:

Hostname shown on the approval page

client_version: str#

1-64 printable ASCII characters, declared by the client.

Type:

CLI version shown on the approval page

code_challenge: str#

Unpadded base64url encoding of the SHA-256 digest of the CLI’s secret code verifier.

code_challenge_method: Literal['S256'] = 'S256'#

Challenge method. Only S256 is supported.

redirect_uri: str | None = None#

Loopback URL (http://127.0.0.1:<port>/callback or http://[::1]:<port>/callback) the browser is sent to after approval. The port must be 1-65535; credentials, query strings, and fragments are refused.

When omitted, the web app shows the authorization code for the user to paste into the CLI instead, which is how login works on a machine without a browser.

state: str | None = None#

Random value of 16 to 256 URL-safe characters, echoed back on the loopback redirect so the CLI can reject callbacks it did not ask for. Required with redirect_uri and rejected without it.

token_expiry_days: int#

Number of days added to token creation time to calculate expiration. The server does not range-check it, the same as CreateTokenRequest.expiry_days.

class roboto.domain.tokens.CreateCredentialRequestResult(/, **data)#

Bases: pydantic.BaseModel

Creation result for a credential request that expires ten minutes after creation.

Parameters:

data (Any)

approval_url: str#

Web app URL where the user reviews and approves the request.

confirmation_code: str#

Short code the CLI prints and the approval page shows, so the user can check they are the same request.

credential_request_id: str#

Unique identifier for the request. Redeeming it also requires its authorization code and secret verifier.

expires: datetime.datetime#

Time after which the request can no longer be approved or redeemed.

class roboto.domain.tokens.CreateTokenRequest(/, **data)#

Bases: pydantic.BaseModel

Request payload to create a new token

Parameters:

data (Any)

api_scopes: set[roboto.auth.scope.ApiScope] | None#
description: str | None#
expiry_days: int#
name: str#
class roboto.domain.tokens.ExchangeCredentialRequestCode(/, **data)#

Bases: pydantic.BaseModel

Redeem an approved request’s authorization code for a personal access token.

Credential values are serialized for exchange, but hidden from model representations and rendered validation errors. Structured validation errors include input by default; use errors(include_input=False) when logging them.

Parameters:

data (Any)

authorization_code: str#

One-time authorization code delivered to the CLI by the loopback redirect or pasted by the user.

code_verifier: str#

Secret verifier whose SHA-256 digest, encoded as unpadded base64url, was sent as code_challenge.

credential_request_id: str#

ID of the request the code was issued for.

model_config#

Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class roboto.domain.tokens.Token(record, roboto_client=None)#

A token allows users and devices to authenticate requests to Roboto.

When a token is generated, a secret value is created which is shared with the user exactly once. This value is required for authentication, if lost a token can be deleted and a new token can be generated.

Parameters:
classmethod create(name, description=None, expiry_days=30, api_scopes=None, roboto_client=None)#

This returns a tuple of the token and the one-time generated secret. After creation, you’ll never be able to retrieve the secret again, so you should save it!

Parameters:
Return type:

tuple[Token, str]

delete()#
Return type:

None

disable()#
Return type:

Token

enable()#
Return type:

Token

classmethod for_self(roboto_client=None)#
Parameters:

roboto_client (Optional[roboto.http.RobotoClient])

Return type:

collections.abc.Collection[Token]

classmethod from_id(token_id, roboto_client=None)#
Parameters:
Return type:

Token

property record: roboto.domain.tokens.record.TokenRecord#
Return type:

roboto.domain.tokens.record.TokenRecord

to_dict()#
Return type:

dict[str, Any]

property token_id: str#
Return type:

str

property user_id: str#
Return type:

str

class roboto.domain.tokens.TokenContext(/, **data)#

Bases: pydantic.BaseModel

Context for token usage

Parameters:

data (Any)

api_scopes: set[roboto.auth.scope.ApiScope]#
description: str | None = None#
enabled: bool = True#
expires: datetime.datetime#
last_used: datetime.datetime | None = None#
name: str#
token_id: str#
class roboto.domain.tokens.TokenRecord(/, **data)#

Bases: pydantic.BaseModel

A wire-transmissible representation of a token.

Parameters:

data (Any)

context: TokenContext | None = None#
secret: str | None = None#
user_id: str | None = None#
On this page