Skip to content

symfonic.platform.transport_records

transport_records

Point-memory routes; scoped reads and authenticated audited deletion.

verified_principal async 

verified_principal(resolver, tenant, authorization, *, request=None)

Preserve authenticated identity for audit, not just its derived scope.

Source code in src/symfonic/platform/transport_records.py 
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
async def verified_principal(resolver, tenant, authorization, *, request=None):
    """Preserve authenticated identity for audit, not just its derived scope."""
    from fastapi import HTTPException

    from symfonic.platform.errors import (
        AuthenticationError,
        AuthorizationError,
        ScopeDerivationError,
    )
    from symfonic.platform.transport_production_gate import gate_native_http_assembly
    from symfonic.platform.values import RequestCredentials

    gate_native_http_assembly(resolver)

    if not tenant or not tenant.strip():
        raise HTTPException(401, "missing X-Tenant-ID")
    headers = dict(request.headers) if request is not None else {}
    headers["x-tenant-id"] = tenant.strip()
    if authorization:
        headers["authorization"] = authorization
    credentials = RequestCredentials(
        headers=headers,
        peer=request.client.host if request is not None and request.client else None,
        user_agent=request.headers.get("user-agent") if request is not None else None,
        route=request.url.path if request is not None else "",
    )
    try:
        value = resolver.resolve(credentials)
        return await value if inspect.isawaitable(value) else value
    except AuthenticationError as denied:
        raise HTTPException(401, str(denied)) from denied
    except AuthorizationError as denied:
        raise HTTPException(403, str(denied)) from denied
    except ScopeDerivationError as invalid:
        raise HTTPException(400, str(invalid)) from invalid