Metadata-Version: 2.4
Name: scalio-tenant
Version: 0.1.0
Summary: Tenant connection of the Scalio apps: own certificate, app registrations in the customer's tenant
License: Proprietary
Requires-Python: >=3.11
Description-Content-Type: text/markdown
Requires-Dist: cryptography>=42
Requires-Dist: httpx>=0.27
Provides-Extra: dev
Requires-Dist: pytest>=8; extra == "dev"
Requires-Dist: ruff>=0.6; extra == "dev"

# scalio-tenant

Tenant connection shared by the Scalio apps (scalio-docs ADR 0036). The app makes its own certificate; the private
key never leaves the instance. The customer's admin runs a setup script that creates the app registration
«Scalio Lesen» (read) or «Scalio Schreiben» (write) in their own tenant with only the public certificate, and pastes
the printed connection code back into the app.

```python
import scalio_tenant as st

cert = st.new_certificate("Scalio Lesen (rosetta.kunde.ch)")      # store cert_pem, encrypt key_pem
text = st.script(st.read_profile(), cert, "rosetta.kunde.ch")    # show to the admin (Azure Cloud Shell)
conn = st.parse_code(pasted, st.read_profile(), cert)            # tenant, client_id, object_id, key_id
info = st.check(conn["tenant"], conn["client_id"], cert, st.read_profile())  # organization, missing roles
token = st.get_token(conn["tenant"], conn["client_id"], cert)
if cert.due():                                                   # 30 days before expiry
    r = st.renew(conn["tenant"], conn["client_id"], conn["object_id"], conn["key_id"], cert, name)
    # store r["cert"] and r["key_id"] at once
```

- `permissions.READ_ROLES`: the Graph application permissions of «Scalio Lesen». `write_profile(roles)` takes the
  roles of the booked modules (the app knows them).
- The app stores the certificate and the encrypted key itself; this package keeps nothing.
- Renewal uses Graph `addKey`/`removeKey` with a proof signed by a key on the registration: no extra permission and
  no admin.

Tests run offline (`pip install -e ".[dev]"`, `pytest`, `ruff check .`); Microsoft is faked with httpx.MockTransport.
