Praxis CI
f2a12f9fed
v0.4 (Operator Tier — Cohort Dashboard + Auth + Postgres) milestone complete. Phases: ✓ P0 pre-execution (planning) → v0.1.6 ✓ P1 operator foundation (Postgres+auth+VC migration) → v0.1.7 ✓ P2 cohort dashboard + aggregation → v0.1.8 ✓ P3 final review + ship → v0.1.9 (= v0.4 milestone release) Requirements covered (8/8): REQ-MT-01 (Postgres store), REQ-MT-02 (aggregation pipeline), REQ-AUTH-01 (operator auth), REQ-DASH-01 (cohort dashboard), REQ-NFR-AUTH-01 (auth NFRs), REQ-NFR-MT-01 (Postgres-in-LXC), REQ-NFR-DASH-01 (k-anonymity ≥10), REQ-NFR-DASH-02 (freshness ≤24h) Grill MUSTs honored (6/6): G-008, G-011, G-027, G-031, G-038, G-041 Tests: 317 pytest pass, 36 skip (Postgres-requiring), 0 fail; 17/17 vitest pass Review: APPROVE_WITH_NOTES (6/6 personas, 0 P0, 8 P1+ carry-forward) Audit: HEALTHY (reconstruction PASS, 8/8 REQ, 6/6 grill) ---ci--- project: praxis phase: 3 milestone: v0.4 status: complete phase_role: final milestone_complete: true milestone_merged_to_main: true tag: v0.1.9 requirements: covered: [REQ-MT-01, REQ-MT-02, REQ-AUTH-01, REQ-DASH-01, REQ-NFR-AUTH-01, REQ-NFR-MT-01, REQ-NFR-DASH-01, REQ-NFR-DASH-02] partial: [] ---/ci---
78 lines
2.3 KiB
Python
78 lines
2.3 KiB
Python
"""GET/POST /api/operator/credentials — VC management (TASK-08-04, D-057).
|
|
|
|
Auth-gated. GET lists issued VCs from Postgres issued_credentials (operator's
|
|
issuance log). POST /{id}/revoke revokes a VC (status='revoked',
|
|
revoked_at=now()). Revoked credentials fail verification. No PII beyond what
|
|
the credential asserts (D-043).
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import datetime as _dt
|
|
|
|
from fastapi import APIRouter, Depends, HTTPException, Request, status
|
|
from pydantic import BaseModel
|
|
|
|
from server.auth.dependencies import current_operator
|
|
from server.auth.models import Operator
|
|
from server.operator._common import require_pg_store
|
|
|
|
router = APIRouter(prefix="/api/operator", tags=["operator-credentials"])
|
|
|
|
|
|
class CredentialOut(BaseModel):
|
|
id: str
|
|
learner_ref: str
|
|
vc_type: str | None = None
|
|
status: str
|
|
issued_at: _dt.datetime | None = None
|
|
revoked_at: _dt.datetime | None = None
|
|
|
|
|
|
class CredentialListResponse(BaseModel):
|
|
credentials: list[CredentialOut]
|
|
|
|
|
|
class OkResponse(BaseModel):
|
|
ok: bool = True
|
|
id: str
|
|
status: str
|
|
|
|
|
|
@router.get("/credentials", response_model=CredentialListResponse)
|
|
async def list_credentials(
|
|
request: Request,
|
|
op: Operator = Depends(current_operator),
|
|
) -> CredentialListResponse:
|
|
pg_store = await require_pg_store(request)
|
|
rows = await pg_store.list_credentials()
|
|
creds = [
|
|
CredentialOut(
|
|
id=str(r["id"]),
|
|
learner_ref=r["learner_ref"],
|
|
vc_type=r.get("vc_type"),
|
|
status=r.get("status", "active"),
|
|
issued_at=r.get("issued_at"),
|
|
revoked_at=r.get("revoked_at"),
|
|
)
|
|
for r in rows
|
|
]
|
|
return CredentialListResponse(credentials=creds)
|
|
|
|
|
|
@router.post("/credentials/{cred_id}/revoke", response_model=OkResponse)
|
|
async def revoke_credential(
|
|
cred_id: str,
|
|
request: Request,
|
|
op: Operator = Depends(current_operator),
|
|
) -> OkResponse:
|
|
pg_store = await require_pg_store(request)
|
|
row = await pg_store.get_credential(cred_id)
|
|
if row is None:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND,
|
|
detail="credential not found")
|
|
await pg_store.set_credential_status(cred_id, "revoked")
|
|
return OkResponse(ok=True, id=cred_id, status="revoked")
|
|
|
|
|
|
__all__ = ["router"] |