Skip to content

symfonic.platform.pending_operator_authority

pending_operator_authority

Private operator verification; no caller principal, HMAC, or dev trust fallback.

The deployment injects its identity verifier and exact operator/scope grants. Signing keys remain with the named verifier custodian; this object never takes key bytes. Custody labels document the configured trust root, not proof that a deployment's external verifier or key store has been audited.

PendingOperatorAuthorizer 

PendingOperatorAuthorizer(*, verifier: TenantAuthVerifier, custody: OperatorIdentityCustody, grants)

Every call reauthenticates credentials and checks an exact native grant.

The trusted verifier must return strict True for operator_authenticated and is_admin, a principal_id and an opaque noncredential authentication_id. Header claims and caller-created AuthenticatedPrincipal are never inputs. Replacing this injected verifier is a deployment configuration privilege.

Source code in src/symfonic/platform/pending_operator_authority.py 
55
56
57
58
59
60
61
62
63
64
65
66
67
68
def __init__(self, *, verifier: TenantAuthVerifier, custody: OperatorIdentityCustody,
             grants):
    if not callable(verifier) or type(custody) is not OperatorIdentityCustody:
        raise AuthorizationError("explicit operator identity verifier is required")
    admitted = set()
    for principal, scope in grants:
        if (not _name(principal) or type(scope) is not MemoryScope
                or scope.identity_version != 1):
            raise AuthorizationError("operator grant requires exact native scope")
        scope.validate()
        admitted.add((principal, scope.path))
    if not admitted:
        raise AuthorizationError("explicit operator full-scope grants are required")
    self._verifier, self._custody, self._grants = verifier, custody, frozenset(admitted)