thunderbird_accounts.authentication.clients

Classes

`KeycloakClient`()
`KeycloakMfaClient`()	Client for self-service, realm-scoped Keycloak calls made as the end user.
`RecoveryCodesResponse`
`RequestMethods`(*values)
`TotpSetupResponse`

class thunderbird_accounts.authentication.clients.RequestMethods(*values)[source]: Bases: StrEnum

class thunderbird_accounts.authentication.clients.TotpSetupResponse[source]: Bases: TypedDict

class thunderbird_accounts.authentication.clients.RecoveryCodesResponse[source]: Bases: TypedDict

class thunderbird_accounts.authentication.clients.KeycloakMfaClient[source]

Bases: object

Client for self-service, realm-scoped Keycloak calls made as the end user.

These use the end user’s forwarded OIDC access token and operate on the token subject: the keycloak-mfa-rest provider (/realms/{realm}/mfa/) plus Keycloak’s built-in Account REST API (/realms/{realm}/account/). Keep this separate from the admin API client so the two trust boundaries cannot accidentally share auth or endpoint routing.

start_totp_setup(user_access_token: str) → TotpSetupResponse[source]: Generate a TOTP secret + otpauth URI for the calling user without writing it.

register_totp_credential(user_access_token: str, secret: str, code: str, user_label: str) → dict[source]: Verify code against secret and register an enrollment-only TOTP credential.

regenerate_recovery_codes(user_access_token: str, user_label: str | None = None) → RecoveryCodesResponse[source]: Replace recovery codes for the calling user and return the plaintext codes once.

logout_other_sessions(user_access_token: str) → bool[source]

Sign the user out of all sessions except the one this token belongs to.

Uses Keycloak’s built-in Account REST API (realm-scoped, self-service), whose DELETE account/sessions preserves the calling session — unlike the admin user-logout, which is logout-all and would evict the current session too (#1005).