orionis.auth.tokens.AccessTokenRepository

THE ORIONIS API

Build with clarity.

Explore the building blocks of an async-first Python framework. Every module, class, and method — connected, searchable, and ready to build with.

Explore modules View classes

class documentation

class AccessTokenRepository(IAccessTokenRepository): (source)

Constructor: AccessTokenRepository(app, db)

View In Hierarchy

Persist personal access tokens through the Orionis query builder.

Tokens are opaque: the client receives a random secret and the store only keeps its SHA-256 digest in a unique column. Verification is a single indexed lookup on that digest, so no plain text secret ever needs to be compared.

Concurrency

Issuance uses a unique digest, with an optional ID lookup for drivers that do not return generated keys. Revocation and usage confirmation use conditional updates. Usage cannot reactivate a revoked token; concurrent timestamps are last-writer-wins. Purging uses two deletes.

Method	`__init__`	Initialise the repository from the token configuration.
Async Method	`create`	Issue a new personal access token for an identity.
Async Method	`findByPlainText`	Resolve a token from the value presented by the client.
Async Method	`purgeExpired`	Delete tokens that expired or were revoked.
Async Method	`revoke`	Revoke a single token.
Async Method	`revokeAll`	Revoke every active token of an identity.
Async Method	`touch`	Confirm token validity and record its use atomically.
Class Variable	`__slots__`	Undocumented
Instance Variable	`__db`	Undocumented
Instance Variable	`__expiration`	Undocumented
Instance Variable	`__secret_bytes`	Undocumented
Instance Variable	`__table`	Undocumented

def __init__(self, app: IApplication, db: IQueryBuilder): (source) ¶

Initialise the repository from the token configuration.

Parameters
app:`IApplication`	Application exposing the `auth.tokens` configuration.
db:`IQueryBuilder`	Gateway used to build queries over the token table.

Returns
`None`	Only configuration values and the gateway are retained.

async def create(self, tokenable: IAuthorizable, name: str, *, abilities: Iterable[str] | None = None, expires_at: datetime | None = None) -> NewAccessToken: (source) ¶

Issue a new personal access token for an identity.

Parameters
tokenable:`IAuthorizable`	Identity the token belongs to.
name:`str`	Human readable label describing the token.
abilities:`Iterable[str] \| None, optional`	Abilities the token may use, or `None` to keep the full authorization of the identity.
expires_at:`datetime \| None, optional`	Explicit expiration. `None` applies the configured default.

Returns
`NewAccessToken`	Stored metadata plus the plain text value of the token.

Raises
`TokenException`	When the token name is empty.

async def findByPlainText(self, plain_text: str) -> AccessToken | None: (source) ¶

Resolve a token from the value presented by the client.

Parameters
plain_text:`str`	Value received in the `Authorization` header.

Returns
`AccessToken \| None`	Matching token, or `None` when the value is unknown, has been revoked or has already expired.

async def purgeExpired(self) -> int: (source) ¶

Delete tokens that expired or were revoked.

Returns
`int`	Number of rows removed from the store.

async def revoke(self, token_id: object) -> bool: (source) ¶

Revoke a single token.

Parameters
token_id:`object`	Identifier of the token to revoke.

Returns
`bool`	True when this call revoked a token that was still active.

async def revokeAll(self, tokenable: IAuthorizable) -> int: (source) ¶

Revoke every active token of an identity.

Parameters
tokenable:`IAuthorizable`	Identity whose tokens must be revoked.

Returns
`int`	Number of tokens revoked by this call.

async def touch(self, token_id: object) -> bool: (source) ¶

Confirm token validity and record its use atomically.

Parameters
token_id:`object`	Identifier of the token to update.

Returns
`bool`	True only if a non-revoked, unexpired row was updated. This is the final validity check before a guard publishes identity.

__slots__: tuple[str, ...] = (source) ¶

Undocumented

__db = (source) ¶

Undocumented

__expiration: int | None = (source) ¶

Undocumented

__secret_bytes: int = (source) ¶

Undocumented

__table: str = (source) ¶

Undocumented