SealSkin

application_keys

Application keys as their user and an administrator manage them (see app.application_keys).

router is the user's own: list, make, and revoke keys, and wake them after a web sign-in. It answers a web sign-in alone, the cookie's or the proxy's, so a key, or a key-file client, cannot make keys: what leaks cannot spread, and the web always wins. admin_router lists and revokes any user's keys, from any sign-in of an administrator's.

attributerouter
= APIRouter(prefix='/api/keys')
attributeadmin_router
= APIRouter(prefix='/api/admin/users', dependencies=[Depends(verify_admin), Depends(routing.announce_changes)], route_class=EncryptedRoute)
attributeWEB_SIGN_INS
= ('root', 'oidc', 'saml', 'proxy')
funcweb_user(user=Depends(verify_token)) -> dict[str, Any]

The caller, who has to be signed in on the web: keys are managed from the web app alone.

paramuserdict[str, Any]
= Depends(verify_token)

Returns

dict[str, typing.Any]
func_listing(username) -> dict[str, Any]

Return a user's keys with the policy over them.

paramusernamestr

Returns

dict[str, typing.Any]
funclist_keys(user=Depends(web_user)) -> dict[str, Any]

Return the caller's keys and what the settings let them do with keys.

paramuserdict[str, Any]
= Depends(web_user)

Returns

dict[str, typing.Any]
funcmake_key(req, user=Depends(web_user)) -> dict[str, Any]

Make a key for the caller and return it with the server's address, this once; 403 disabled where the settings deny keys, 400 days over the longest lifetime.

paramreqApplicationKeyCreateRequest
paramuserdict[str, Any]
= Depends(web_user)

Returns

dict[str, typing.Any]
funcrevoke_key(key_id, user=Depends(web_user)) -> Response

Take one of the caller's keys back.

paramkey_idstr
paramuserdict[str, Any]
= Depends(web_user)

Returns

fastapi.Response
funcwake_keys(request, user=Depends(web_user)) -> dict[str, Any]

Count the caller's web sign-in as happening now, which wakes keys the dormancy rules put to sleep.

A browser that still holds a sign-in opens the web app without signing in again, so the companion app's "sign in on the web" lands here.

paramrequestRequest
paramuserdict[str, Any]
= Depends(web_user)

Returns

dict[str, typing.Any]
funclist_user_keys(username) -> list[dict[str, Any]]

Return a user's keys.

paramusernamestr

Returns

list[dict[str, typing.Any]]
funcrevoke_user_key(username, key_id, admin=Depends(verify_admin)) -> Response

Take one of a user's keys back.

paramusernamestr
paramkey_idstr
paramadmindict[str, Any]
= Depends(verify_admin)

Returns

fastapi.Response
funcrevoke_user_keys(username) -> Response

Take every key of a user back.

paramusernamestr

Returns

fastapi.Response