roboto.domain.tokens.operations

Module Contents

class roboto.domain.tokens.operations.CreateCredentialRequest(/, **data)

Bases: pydantic.BaseModel

Request payload to create a credential request.

The CLI redeems the request for a personal access token after a user approves it in the browser.

Parameters:

data (Any)

client_hostname: str

1-255 printable ASCII characters, declared by the client.

Type:

Hostname shown on the approval page

client_version: str

1-64 printable ASCII characters, declared by the client.

Type:

CLI version shown on the approval page

code_challenge: str

Unpadded base64url encoding of the SHA-256 digest of the CLI’s secret code verifier.

code_challenge_method: Literal['S256'] = 'S256'

Challenge method. Only S256 is supported.

redirect_uri: str | None = None

Loopback URL (http://127.0.0.1:<port>/callback or http://[::1]:<port>/callback) the browser is sent to after approval. The port must be 1-65535; credentials, query strings, and fragments are refused.

When omitted, the web app shows the authorization code for the user to paste into the CLI instead, which is how login works on a machine without a browser.

state: str | None = None

Random value of 16 to 256 URL-safe characters, echoed back on the loopback redirect so the CLI can reject callbacks it did not ask for. Required with redirect_uri and rejected without it.

token_expiry_days: int

Number of days added to token creation time to calculate expiration. The server does not range-check it, the same as CreateTokenRequest.expiry_days.

class roboto.domain.tokens.operations.CreateCredentialRequestResult(/, **data)

Bases: pydantic.BaseModel

Creation result for a credential request that expires ten minutes after creation.

Parameters:

data (Any)

approval_url: str

Web app URL where the user reviews and approves the request.

confirmation_code: str

Short code the CLI prints and the approval page shows, so the user can check they are the same request.

credential_request_id: str

Unique identifier for the request. Redeeming it also requires its authorization code and secret verifier.

expires: datetime.datetime

Time after which the request can no longer be approved or redeemed.

class roboto.domain.tokens.operations.CreateTokenRequest(/, **data)

Bases: pydantic.BaseModel

Request payload to create a new token

Parameters:

data (Any)

api_scopes: set[roboto.auth.scope.ApiScope] | None

description: str | None

expiry_days: int

name: str

class roboto.domain.tokens.operations.ExchangeCredentialRequestCode(/, **data)

Bases: pydantic.BaseModel

Redeem an approved request’s authorization code for a personal access token.

Credential values are serialized for exchange, but hidden from model representations and rendered validation errors. Structured validation errors include input by default; use errors(include_input=False) when logging them.

Parameters:

data (Any)

authorization_code: str

One-time authorization code delivered to the CLI by the loopback redirect or pasted by the user.

code_verifier: str

Secret verifier whose SHA-256 digest, encoded as unpadded base64url, was sent as code_challenge.

credential_request_id: str

ID of the request the code was issued for.

model_config

Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].