app.auth.push¶
CI push-token checks for candidate intake (not OIDC).
Push tokens are per-registration shared secrets resolved at startup
from the env var names listed in push_tokens_env
(push_tokens). They
authorize exactly one thing: writing candidates to that registration
through PUT/POST /api/v1/candidates. They grant no catalog
read access (read routes accept only OIDC/dev JWTs, and a push token
is not a JWT), and OIDC/dev tokens are never accepted for intake (they
never equal a configured push token).
Comparison is constant-time: both sides are hashed with SHA-256 first
(so token length does not leak either) and compared with
hmac.compare_digest(); every configured token is compared, with
no early exit. Tokens are never logged or stored.
Public API: token_matches(), registrations_for_token().
- app.auth.push.registrations_for_token(sources, presented)¶
List the registrations whose push tokens include presented.
Used only when a request does not name a usable registration, to decide between 401 (token valid nowhere) and a request error.
- Parameters:
sources (
Sequence[SourceRegistration]) – All configured registrations.presented (
str) – The bearer token of the request.
- Return type:
- Returns:
Matching registrations (every one is checked).
- app.auth.push.token_matches(tokens, presented)¶
Tell whether presented equals one of tokens (constant time).