API: authweave-workload¶

Workload lifecycle and sender-constrained Resource Server profiles. Optional extras stay lazy; base imports must not pull Litestar, Redis, or cryptography implementations.

Framework-neutral workload authentication.

`PAYMENT_AUTHORIZATION_TYPE = 'https://zylvext.github.io/litestar-auth/schemas/payment-authorization-v1'` `module-attribute` ¶

all = ('PAYMENT_AUTHORIZATION_TYPE', 'CertificateMetadata', 'CredentialStatus', 'DirectMTLSPolicy', 'DirectMTLSProvider', 'EntityStatus', 'EventRecorder', 'LifecycleConflictError', 'MachineCredential', 'MachineCredentialStore', 'MachinePrincipal', 'MachinePrincipalStore', 'PaymentAction', 'PaymentAuthorizationDetail', 'PaymentAuthorizationError', 'PaymentAuthorizationPolicy', 'ResolvedMachineIdentity', 'SecurityEvent', 'SecurityEventType', 'ServiceApplication', 'ServiceApplicationStore', 'StoreConflictError', 'StoreOwnerStateConflictError', 'StoreUnavailableError', 'WorkloadLifecycleService', 'WorkloadPage', 'WorkloadRateLimitIdentity', 'WorkloadStore', 'version', 'find_payment_authorization', 'parse_payment_authorization_details', 'rate_limit_identity', 'validate_payment_authorization_narrowing') `module-attribute` ¶

`version = '8.0.2'` `module-attribute` ¶

`EventRecorder = Callable[[SecurityEvent], object]` ¶

`PaymentAction = Literal['initiate', 'status', 'cancel', 'refund']` ¶

`CertificateMetadata` `dataclass` ¶

Opaque public-certificate facts produced by an AuthWeave validator.

`new()` ¶

Prevent construction outside the certificate validator.

Raises:

Type	Description
`TypeError`	If the call cannot complete.

`__post_init__()` ¶

Reuse credential validation through bounded primitive checks.

Raises:

Type	Description
`ValueError`	If the call cannot complete.

`CredentialStatus` ¶

Bases: StrEnum

Lifecycle status for registered public credentials.

`DirectMTLSPolicy` `dataclass` ¶

Trusted TLS termination and certificate evidence policy.

`__post_init__()` ¶

Reject empty or unsafe policy configuration.

Raises:

Type	Description
`ValueError`	If the call cannot complete.

`DirectMTLSProvider` ¶

Authenticate a registered machine identity from trusted TLS evidence.

`init(*, name, store, policy, event_callback=None)` ¶

Bind credential persistence and the trusted boundary policy.

`authenticate(request, runtime)` `async` ¶

Authenticate and fail closed if mandatory event delivery fails (ADR 0001).

Returns:

Type	Description
`AuthenticationDecision`	A terminal typed authentication decision.

`match(request)` ¶

Own verified TLS evidence and reject mixed credential presentations.

Returns:

Type	Description
`CredentialMatch`	The match.

`EntityStatus` ¶

Bases: StrEnum

Lifecycle status shared by applications and principals.

`LifecycleConflictError` ¶

Bases: Exception

Raised when a requested lifecycle transition is invalid.

`MachineCredential` `dataclass` ¶

Registered public X.509 credential identity and constraints.

`__post_init__()` ¶

Validate bounded credential identity and temporal constraints.

Raises:

Type	Description
`ValueError`	If the call cannot complete.

`MachineCredentialStore` ¶

Bases: Protocol

Persistence operations requiring atomic credential lifecycle semantics.

`complete_rotation(replacement_id, previous_id, *, completed_at)` `async` ¶

Complete rotation.

`get_credential(credential_id)` `async` ¶

Return the credential.

`list_credentials(principal_id)` `async` ¶

Return one page of credentials.

`record_last_used(credential_id, *, used_at_epoch, minimum_interval)` `async` ¶

Record last used.

`register_credential(credential, *, active_limit)` `async` ¶

Recheck active application/principal state before enforcing the limit and inserting.

`resolve_by_thumbprint(thumbprint)` `async` ¶

Resolve by thumbprint.

`revoke_credential(credential_id, *, reason, revoked_at)` `async` ¶

Revoke the credential.

`MachinePrincipal` `dataclass` ¶

Registered non-human security identity.

`__post_init__()` ¶

Validate public IDs and supported principal classification.

Raises:

Type	Description
`ValueError`	If the call cannot complete.

`MachinePrincipalStore` ¶

Bases: Protocol

Persistence operations for machine principals.

`create_principal(principal)` `async` ¶

Persist only when the owning application is active at write time.

`get_principal(principal_id)` `async` ¶

Return the principal.

`list_principals(*, application_id, offset, limit, status=None)` `async` ¶

Return one page of principals and the matching total count.

`set_principal_metadata(principal_id, metadata)` `async` ¶

Update the principal metadata.

`set_principal_status(principal_id, status)` `async` ¶

Update the principal status.

`PaymentAuthorizationDetail` `dataclass` ¶

One immutable payment authority entry.

`__post_init__()` ¶

Validate the exact v1 value domain.

Raises:

Type	Description
`PaymentAuthorizationError`	If a field violates the v1 schema.

`as_evidence()` ¶

Return the exact RFC 9396 mapping stored on authentication evidence.

Returns:

Type	Description
`Mapping[str, AuthorizationValue]`	JSON-compatible payment authorization detail.

`contains(requested)` ¶

Return whether requested is no broader than this detail.

Returns:

Type	Description
`bool`	Whether every requested authority dimension is contained.

`PaymentAuthorizationError` ¶

Bases: ValueError

Raised when payment authority is malformed or widens its parent authority.

`PaymentAuthorizationPolicy` `dataclass` ¶

Issuer-specific trust ceilings for payment authorization details.

`__post_init__()` ¶

Freeze and validate scope, location, and currency ceilings.

Raises:

Type	Description
`PaymentAuthorizationError`	If a policy ceiling is invalid.

`from_evidence(evidence)` ¶

Recover typed details from already verified authentication evidence.

Returns:

Type	Description
`tuple[PaymentAuthorizationDetail, ...]`	Immutable typed payment authority.

`parse(value, *, scopes)` ¶

Parse details under this issuer policy and verified scopes.

Returns:

Type	Description
`tuple[PaymentAuthorizationDetail, ...]`	Immutable typed payment authority.

`ResolvedMachineIdentity` `dataclass` ¶

Atomic application, principal, and credential lookup result.

`SecurityEvent` `dataclass` ¶

One bounded event with no raw credential or certificate body.

`__post_init__()` ¶

Require an aware timestamp.

Raises:

Type	Description
`ValueError`	If the timestamp has no timezone.

`SecurityEventType` ¶

Bases: StrEnum

Stable event classes emitted by workload lifecycle and providers.

`ServiceApplication` `dataclass` ¶

Registered integration and ownership aggregate.

`__post_init__()` ¶

Validate stable public fields.

Raises:

Type	Description
`ValueError`	If the call cannot complete.

`ServiceApplicationStore` ¶

Bases: Protocol

Persistence operations for application registrations.

`create_application(application)` `async` ¶

Persist the new application.

`get_application(application_id)` `async` ¶

Return the application.

`list_applications(*, offset, limit, owner_ref=None, environment=None, status=None)` `async` ¶

Return one page of applications and the matching total count.

`set_application_metadata(application_id, metadata)` `async` ¶

Update the application metadata.

`set_application_status(application_id, status)` `async` ¶

Update the application status.

`StoreConflictError` ¶

Bases: Exception

Raised when a persistence uniqueness or lifecycle invariant is violated.

`StoreOwnerStateConflictError` ¶

Bases: StoreConflictError

Raised when a concurrently revalidated owner no longer permits a write.

`StoreUnavailableError` ¶

Bases: Exception

Raised when persistence cannot safely complete an authentication lookup.

`WorkloadLifecycleService` ¶

Perform explicit application, principal, and public credential transitions.

`init(store, *, issuer, actor, correlation_id, event_recorder, active_credential_limit=4, maximum_rotation_lead=timedelta(days=7))` ¶

Bind persistence and bounded lifecycle policy.

Raises:

Type	Description
`ValueError`	If the call cannot complete.

`complete_rotation(*, new_credential_id, previous_credential_id, now=None)` `async` ¶

Activate a valid replacement and revoke its predecessor.

Returns:

Type	Description
`tuple[MachineCredential, MachineCredential, SecurityEvent]`	The complete rotation.

Raises:

Type	Description
`ValueError`	If the call cannot complete.
`LifecycleConflictError`	If the call cannot complete.

`create_application(*, application_id, environment, owner_ref, metadata=_EMPTY_METADATA)` `async` ¶

Create an enabled service application.

Returns:

Type	Description
`tuple[ServiceApplication, SecurityEvent]`	The created application.

`create_principal(*, principal_id, application_id, subject, kind, metadata=_EMPTY_METADATA)` `async` ¶

Create an enabled machine principal under an existing application.

Returns:

Type	Description
`tuple[MachinePrincipal, SecurityEvent]`	The created principal.

Raises:

Type	Description
`LifecycleConflictError`	If the call cannot complete.

`list_applications(*, offset=0, limit=50, owner_ref=None, environment=None, status=None)` `async` ¶

Return a bounded deterministic application inventory page.

`list_credentials(principal_id)` `async` ¶

Return safe registered metadata for one principal.

`list_principals(*, application_id, offset=0, limit=50, status=None)` `async` ¶

Return a bounded deterministic principal inventory page for one application.

`register_credential(*, principal_id, certificate, scopes, audiences, environment, metadata=_EMPTY_METADATA, rotation_of=None, now=None)` `async` ¶

Register validated public certificate metadata without retaining certificate bytes.

Returns:

Type	Description
`tuple[MachineCredential, SecurityEvent]`	The register credential.

Raises:

Type	Description
`ValueError`	If the call cannot complete.
`LifecycleConflictError`	If the call cannot complete.

`revoke_credential(credential_id, *, reason, now=None)` `async` ¶

Revoke one credential immediately.

Returns:

Type	Description
`tuple[MachineCredential, SecurityEvent]`	The revoke credential.

Raises:

Type	Description
`ValueError`	If the call cannot complete.
`LifecycleConflictError`	If the call cannot complete.

`set_application_enabled(application_id, *, enabled)` `async` ¶

Enable or disable one application.

Returns:

Type	Description
`tuple[ServiceApplication, SecurityEvent]`	The set application enabled.

Raises:

Type	Description
`LifecycleConflictError`	If the call cannot complete.

`set_principal_enabled(principal_id, *, enabled)` `async` ¶

Enable or disable one machine principal.

Returns:

Type	Description
`tuple[MachinePrincipal, SecurityEvent]`	The set principal enabled.

Raises:

Type	Description
`LifecycleConflictError`	If the call cannot complete.

`update_application_metadata(application_id, metadata)` `async` ¶

Replace bounded safe application metadata.

Returns:

Type	Description
`tuple[ServiceApplication, SecurityEvent]`	The update application metadata.

Raises:

Type	Description
`LifecycleConflictError`	If the call cannot complete.

`update_principal_metadata(principal_id, metadata)` `async` ¶

Replace bounded safe principal metadata.

Returns:

Type	Description
`tuple[MachinePrincipal, SecurityEvent]`	The update principal metadata.

Raises:

Type	Description
`LifecycleConflictError`	If the call cannot complete.

`WorkloadPage` `dataclass` ¶

One deterministic bounded page of workload inventory results.

`__post_init__()` ¶

Reject internally inconsistent page metadata.

Raises:

Type	Description
`ValueError`	If the call cannot complete.

`WorkloadRateLimitIdentity` `dataclass` ¶

Rotation-stable and credential-specific rate-limit keys.

`WorkloadStore` ¶

Bases: ServiceApplicationStore, MachinePrincipalStore, MachineCredentialStore, Protocol

Combined transactional store used by lifecycle services.

`find_payment_authorization(details, requested)` ¶

Find verified OAuth authority covering one application payment operation.

Returns:

Type	Description
`PaymentAuthorizationDetail \| None`	The covering detail, or `None`. This is not a business approval.

`parse_payment_authorization_details(value, *, policy, scopes)` ¶

Validate one payment claim without accepting other RFC 9396 types.

Returns:

Type	Description
`tuple[PaymentAuthorizationDetail, ...]`	Immutable typed payment authority.

Raises:

Type	Description
`PaymentAuthorizationError`	If the claim is absent, malformed, or too broad.

`rate_limit_identity(context)` ¶

Build stable workload rate-limit identity from verified evidence.

Returns:

Type	Description
`WorkloadRateLimitIdentity`	Application, principal, and optional credential identities.

Raises:

Type	Description
`TypeError`	If the context is not an authweave-workload result.

`validate_payment_authorization_narrowing(granted, requested)` ¶

Reject any requested detail not contained by one granted detail.

Returns:

Type	Description
`tuple[PaymentAuthorizationDetail, ...]`	The unchanged narrower request.

Raises:

Type	Description
`PaymentAuthorizationError`	If requested authority widens the grant.

API: authweave-workload¶

PAYMENT_AUTHORIZATION_TYPE = 'https://zylvext.github.io/litestar-auth/schemas/payment-authorization-v1' module-attribute ¶

__version__ = '8.0.2' module-attribute ¶

EventRecorder = Callable[[SecurityEvent], object] ¶

PaymentAction = Literal['initiate', 'status', 'cancel', 'refund'] ¶

CertificateMetadata dataclass ¶

__new__() ¶

__post_init__() ¶

CredentialStatus ¶

DirectMTLSPolicy dataclass ¶

__post_init__() ¶

DirectMTLSProvider ¶

__init__(*, name, store, policy, event_callback=None) ¶

authenticate(request, runtime) async ¶

match(request) ¶

EntityStatus ¶

LifecycleConflictError ¶

MachineCredential dataclass ¶

__post_init__() ¶

MachineCredentialStore ¶

complete_rotation(replacement_id, previous_id, *, completed_at) async ¶

get_credential(credential_id) async ¶

list_credentials(principal_id) async ¶

record_last_used(credential_id, *, used_at_epoch, minimum_interval) async ¶

register_credential(credential, *, active_limit) async ¶

resolve_by_thumbprint(thumbprint) async ¶

revoke_credential(credential_id, *, reason, revoked_at) async ¶

MachinePrincipal dataclass ¶

__post_init__() ¶

MachinePrincipalStore ¶

create_principal(principal) async ¶

get_principal(principal_id) async ¶

list_principals(*, application_id, offset, limit, status=None) async ¶

set_principal_metadata(principal_id, metadata) async ¶

set_principal_status(principal_id, status) async ¶

PaymentAuthorizationDetail dataclass ¶

__post_init__() ¶

as_evidence() ¶

contains(requested) ¶

PaymentAuthorizationError ¶

PaymentAuthorizationPolicy dataclass ¶

__post_init__() ¶

from_evidence(evidence) ¶

parse(value, *, scopes) ¶

ResolvedMachineIdentity dataclass ¶

SecurityEvent dataclass ¶

__post_init__() ¶

SecurityEventType ¶

ServiceApplication dataclass ¶

__post_init__() ¶

ServiceApplicationStore ¶

create_application(application) async ¶

get_application(application_id) async ¶

list_applications(*, offset, limit, owner_ref=None, environment=None, status=None) async ¶

set_application_metadata(application_id, metadata) async ¶

set_application_status(application_id, status) async ¶

StoreConflictError ¶

StoreOwnerStateConflictError ¶

StoreUnavailableError ¶

WorkloadLifecycleService ¶

__init__(store, *, issuer, actor, correlation_id, event_recorder, active_credential_limit=4, maximum_rotation_lead=timedelta(days=7)) ¶

complete_rotation(*, new_credential_id, previous_credential_id, now=None) async ¶

create_application(*, application_id, environment, owner_ref, metadata=_EMPTY_METADATA) async ¶

create_principal(*, principal_id, application_id, subject, kind, metadata=_EMPTY_METADATA) async ¶

list_applications(*, offset=0, limit=50, owner_ref=None, environment=None, status=None) async ¶

list_credentials(principal_id) async ¶

list_principals(*, application_id, offset=0, limit=50, status=None) async ¶

register_credential(*, principal_id, certificate, scopes, audiences, environment, metadata=_EMPTY_METADATA, rotation_of=None, now=None) async ¶

revoke_credential(credential_id, *, reason, now=None) async ¶

set_application_enabled(application_id, *, enabled) async ¶

set_principal_enabled(principal_id, *, enabled) async ¶

update_application_metadata(application_id, metadata) async ¶

update_principal_metadata(principal_id, metadata) async ¶

WorkloadPage dataclass ¶

__post_init__() ¶

WorkloadRateLimitIdentity dataclass ¶

WorkloadStore ¶

find_payment_authorization(details, requested) ¶

parse_payment_authorization_details(value, *, policy, scopes) ¶

rate_limit_identity(context) ¶

`PAYMENT_AUTHORIZATION_TYPE = 'https://zylvext.github.io/litestar-auth/schemas/payment-authorization-v1'` `module-attribute` ¶

`version = '8.0.2'` `module-attribute` ¶

`EventRecorder = Callable[[SecurityEvent], object]` ¶

`PaymentAction = Literal['initiate', 'status', 'cancel', 'refund']` ¶

`CertificateMetadata` `dataclass` ¶

`new()` ¶

`__post_init__()` ¶

`CredentialStatus` ¶

`DirectMTLSPolicy` `dataclass` ¶

`__post_init__()` ¶

`DirectMTLSProvider` ¶

`init(*, name, store, policy, event_callback=None)` ¶

`authenticate(request, runtime)` `async` ¶

`match(request)` ¶

`EntityStatus` ¶

`LifecycleConflictError` ¶

`MachineCredential` `dataclass` ¶

`__post_init__()` ¶

`MachineCredentialStore` ¶

`complete_rotation(replacement_id, previous_id, *, completed_at)` `async` ¶

`get_credential(credential_id)` `async` ¶

`list_credentials(principal_id)` `async` ¶

`record_last_used(credential_id, *, used_at_epoch, minimum_interval)` `async` ¶

`register_credential(credential, *, active_limit)` `async` ¶

`resolve_by_thumbprint(thumbprint)` `async` ¶

`revoke_credential(credential_id, *, reason, revoked_at)` `async` ¶

`MachinePrincipal` `dataclass` ¶

`__post_init__()` ¶

`MachinePrincipalStore` ¶

`create_principal(principal)` `async` ¶

`get_principal(principal_id)` `async` ¶

`list_principals(*, application_id, offset, limit, status=None)` `async` ¶

`set_principal_metadata(principal_id, metadata)` `async` ¶

`set_principal_status(principal_id, status)` `async` ¶

`PaymentAuthorizationDetail` `dataclass` ¶

`__post_init__()` ¶

`as_evidence()` ¶

`contains(requested)` ¶

`PaymentAuthorizationError` ¶

`PaymentAuthorizationPolicy` `dataclass` ¶

`__post_init__()` ¶

`from_evidence(evidence)` ¶

`parse(value, *, scopes)` ¶

`ResolvedMachineIdentity` `dataclass` ¶

`SecurityEvent` `dataclass` ¶

`__post_init__()` ¶

`SecurityEventType` ¶

`ServiceApplication` `dataclass` ¶

`__post_init__()` ¶

`ServiceApplicationStore` ¶

`create_application(application)` `async` ¶

`get_application(application_id)` `async` ¶

`list_applications(*, offset, limit, owner_ref=None, environment=None, status=None)` `async` ¶

`set_application_metadata(application_id, metadata)` `async` ¶

`set_application_status(application_id, status)` `async` ¶

`StoreConflictError` ¶

`StoreOwnerStateConflictError` ¶

`StoreUnavailableError` ¶

`WorkloadLifecycleService` ¶

`init(store, *, issuer, actor, correlation_id, event_recorder, active_credential_limit=4, maximum_rotation_lead=timedelta(days=7))` ¶

`complete_rotation(*, new_credential_id, previous_credential_id, now=None)` `async` ¶

`create_application(*, application_id, environment, owner_ref, metadata=_EMPTY_METADATA)` `async` ¶

`create_principal(*, principal_id, application_id, subject, kind, metadata=_EMPTY_METADATA)` `async` ¶

`list_applications(*, offset=0, limit=50, owner_ref=None, environment=None, status=None)` `async` ¶

`list_credentials(principal_id)` `async` ¶

`list_principals(*, application_id, offset=0, limit=50, status=None)` `async` ¶

`register_credential(*, principal_id, certificate, scopes, audiences, environment, metadata=_EMPTY_METADATA, rotation_of=None, now=None)` `async` ¶

`revoke_credential(credential_id, *, reason, now=None)` `async` ¶

`set_application_enabled(application_id, *, enabled)` `async` ¶

`set_principal_enabled(principal_id, *, enabled)` `async` ¶

`update_application_metadata(application_id, metadata)` `async` ¶

`update_principal_metadata(principal_id, metadata)` `async` ¶

`WorkloadPage` `dataclass` ¶

`__post_init__()` ¶

`WorkloadRateLimitIdentity` `dataclass` ¶

`WorkloadStore` ¶

`find_payment_authorization(details, requested)` ¶

`parse_payment_authorization_details(value, *, policy, scopes)` ¶

`rate_limit_identity(context)` ¶

`validate_payment_authorization_narrowing(granted, requested)` ¶