thunderbird_accounts.authentication.clients

Classes

`ActiveSessionResponse`
`ConnectedAppResponse`
`KeycloakAccountClient`()	Client for Keycloak's built-in Account REST API.
`KeycloakClient`()
`KeycloakMfaClient`()	Client for the keycloak-mfa-rest provider.
`KeycloakSelfServiceClient`()	Base client for realm-scoped Keycloak calls made as the end user.
`RecoveryCodesResponse`
`RequestMethods`(*values)
`TotpSetupResponse`

class thunderbird_accounts.authentication.clients.RequestMethods(*values)[source]: Bases: StrEnum

class thunderbird_accounts.authentication.clients.TotpSetupResponse[source]: Bases: TypedDict

class thunderbird_accounts.authentication.clients.RecoveryCodesResponse[source]: Bases: TypedDict

class thunderbird_accounts.authentication.clients.ActiveSessionResponse[source]: Bases: GeoIPSession

class thunderbird_accounts.authentication.clients.ConnectedAppResponse[source]: Bases: GeoIPSession

class thunderbird_accounts.authentication.clients.KeycloakSelfServiceClient[source]

Bases: object

Base client for realm-scoped Keycloak calls made as the end user.

These use the end user’s forwarded OIDC access token and operate on the token subject: Keycloak’s built-in Account REST API and our self-service provider APIs. Keep this separate from the admin API client so the two trust boundaries cannot accidentally share auth or endpoint routing.

class thunderbird_accounts.authentication.clients.KeycloakAccountClient[source]

Bases: KeycloakSelfServiceClient

Client for Keycloak’s built-in Account REST API.

logout_other_sessions(user_access_token: str) → bool[source]

Sign the user out of all sessions except the one this token belongs to.

Keycloak’s Account API preserves the calling session unlike the admin user-logout, which is logout-all and would evict it too (#1005).

class thunderbird_accounts.authentication.clients.KeycloakMfaClient[source]

Bases: KeycloakSelfServiceClient

Client for the keycloak-mfa-rest provider.

start_totp_setup(user_access_token: str) → TotpSetupResponse[source]: Generate a TOTP secret + otpauth URI for the calling user without writing it.

register_totp_credential(user_access_token: str, secret: str, code: str, user_label: str) → dict[source]: Verify code against secret and register an enrollment-only TOTP credential.

regenerate_recovery_codes(user_access_token: str, user_label: str | None = None) → RecoveryCodesResponse[source]: Replace recovery codes for the calling user and return the plaintext codes once.