orionis.auth.tokens.repository

THE ORIONIS API

Build with clarity.

Explore the building blocks of an async-first Python framework. Every module, class, and method — connected, searchable, and ready to build with.

Explore modules View classes

module documentation

(source)

Undocumented

Function	`_as_datetime`	Coerce a stored timestamp into a datetime.
Function	`_decode_abilities`	Deserialise the abilities stored for a token.
Function	`_encode_abilities`	Serialise the abilities of a token for storage.
Function	`_is_expired`	Report whether an expiration moment already elapsed.
Function	`_normalize_abilities`	Validate credential restrictions without coercing malformed values.
Function	`_unexpired_tokens`	Group the nullable expiration constraint for token use.
Function	`_utc_now`	Return the current UTC moment as a naive datetime.
Constant	`_DEFAULT_SECRET_BYTES`	Undocumented
Constant	`_DEFAULT_TABLE`	Undocumented
Constant	`_MAX_ABILITIES`	Undocumented
Constant	`_MAX_NAME_LENGTH`	Undocumented
Constant	`_MAX_TOKEN_LENGTH`	Undocumented
Constant	`_TOKEN_COLUMN`	Undocumented

def _as_datetime(value: object) -> datetime | None: (source) ¶

Coerce a stored timestamp into a datetime.

Queries over a table the builder knows no schema for come back with whatever the driver produced, and SQLite hands timestamps back as plain strings. Normalising here keeps the expiration check correct on every dialect.

Parameters
value:`object`	Raw value read from a timestamp column.

Returns
`datetime \| None`	Parsed UTC moment without an offset, or `None` for SQL NULL.

Raises
`TokenException`	If a non-null timestamp is malformed.

def _decode_abilities(value: object) -> frozenset[str] | None: (source) ¶

Deserialise the abilities stored for a token.

Parameters
value:`object`	Raw value read from the `abilities` column.

Returns
`frozenset[str] \| None`	Validated abilities, or `None` only for a SQL NULL value.

Raises
`TokenException`	If the stored payload is not an array of non-empty strings.

def _encode_abilities(abilities: frozenset[str] | None) -> str | None: (source) ¶

Serialise the abilities of a token for storage.

Parameters
abilities:`frozenset[str] \| None`	Abilities granted to the token.

Returns
`str \| None`	Sorted JSON array, or `None` for an unrestricted token.

def _is_expired(value: datetime | None) -> bool: (source) ¶

Report whether an expiration moment already elapsed.

Parameters
value:`datetime \| None`	Normalised expiration moment of the token.

Returns
`bool`	True when the moment is in the past. A missing value means the token never expires on its own.

def _normalize_abilities(abilities: Iterable[str] | None) -> frozenset[str] | None: (source) ¶

Validate credential restrictions without coercing malformed values.

Parameters
abilities:`Iterable[str] \| None`	Explicit restrictions, or None for an unrestricted credential.

Returns
`frozenset[str] \| None`	Deduplicated, validated abilities.

Raises
`TokenException`	If the input is a string or contains invalid ability names.

def _unexpired_tokens(query: QueryBuilderBase): (source) ¶

Group the nullable expiration constraint for token use.

Parameters
query:`QueryBuilderBase`	Nested group assembled by the query builder.

Returns
`None`	The group accepts only unexpired tokens or SQL NULL deadlines.

def _utc_now() -> datetime: (source) ¶

Return the current UTC moment as a naive datetime.

Token columns are declared without a timezone so every dialect stores the same value. Dropping the offset here keeps writes and reads symmetric across SQLite, PostgreSQL and MySQL.